> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/linux/nibbles.md).

# Nibbles

Writeup for Nibbles from offsec Proving Grounds

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.163.47 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F8X805dEfvA6qYiQ3g8r8%2Fimage.png?alt=media\&token=573da6b2-0a1a-4107-8ec6-2909bd752c62)

### Service Enumeration

### HTTP (Port 80)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FCEySTLLDL4flKqHPw6f7%2Fimage.png?alt=media\&token=b4ffa4d6-2f91-4886-b136-2afc0fcb1195)

Looks like a blank website used for testing.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fi9s9NJLx22NRQ9GqQCJt%2Fimage.png?alt=media\&token=868abd05-26ef-43cb-9da6-1bf8751a620a)

Doesn't look like there's anything else here that could be useful.

### Postgresql (Port 5437)

Since we know the default username is `postgres`, we can try the default password as well, `postgres`, and we managed to log in.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FB60cPEMDhcVIrVrEK26l%2Fimage.png?alt=media\&token=c6842ded-596d-464b-8b99-78c1968e0100)

Since this version of `postgresql` is higher than 9.3 and we are super user, we can run the following exploit.

{% embed url="<https://www.exploit-db.com/exploits/46813>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FSaLVN993YiCNLoITasOl%2Fimage.png?alt=media\&token=c2d11242-44f2-41c5-8115-8da78e9cbe55)

## Exploit

Let's use Metasploit for this exploit to make life easier.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FF2gyPs3fHx69sEFgBDjB%2Fimage.png?alt=media\&token=4aff62f7-9535-4e48-b32e-88103221d25e)

And we got an interactive shell!

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FG6gPVhoQ7qlnoOoGemf8%2Fimage.png?alt=media\&token=ed4d71eb-59e3-4295-aed6-0e802e835bf6)

## Privesc

Running LinEnum on the target machine, we find an interesting SUID file.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FryEyqoSU8XEqNdf6TZOC%2Fimage.png?alt=media\&token=37a9ee96-b5a6-489e-9b23-175ea1b243e2)

Searching on GTFObins and we got the exact command needed.

{% embed url="<https://gtfobins.github.io/gtfobins/find#suid>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlQksJuWQJwyqq57GZFLL%2Fimage.png?alt=media\&token=929f815c-2314-4b34-b929-0a05cfa2a23b)