Walkthrough: Nibbles

Platform - Proving Grounds Practice

Level - Easy

Service Enumeration

Port Scan results

FTP Enumeration (TCP/21)

Upon manual enumeration of the available FTP service, no foothold was achieved.

SSH Enumeration (TCP/22)

Upon manual enumeration of the available SSH service, no foothold was achieved.

HTTP enumeration (TCP/80)

Upon manual enumeration of the available HTTP service, no foothold was achieved.

POSTGRESQL enumeration (TCP/5437)

Upon manual enumeration the service Postgresql DB 11.3 - 11.7 was exploitable with Exploit EDB-50847 and using default credentials "postgres : postgres"

PROOF OF CONCEPET - POSTGRESQL Injection

Using psql command we get the login of the user. After login to the postgresql database panel, we note that we are privileged user with superuser role.

Creating a reverse shell payload

We get the reverse shell, and we discover under user wilson our first flag!

PRIVILEGE ESCALATION

We have got low privileged shell as postgres. Using LinPEAS automation script suggested that the SUID setting "find" command could be abused for privilege escalation.

Checking GTFO Bins for find reveals

Running the command without "sudo" and received the shell, PROOF Flag!