HTB — Nibbles

CYBER_delta

Oct 28, 2026

--

Listen

Share

Enumurate with Metasploit

i Learned

• Enumeration — identify Nibbleblog and discover its version.
• Information disclosure — inspect users.xml to discover the username admin.
• Metasploit — configure and use the nibbleblog_file_upload exploit.
• Reverse shells — understand LHOST, LPORT, and Meterpreter sessions.
• Linux enumeration — use whoami, id, ls -la, and sudo -l.
• Privilege escalation — identify a root-executable script that is writable by nibbler.
• File handling — extract personal.zip to recover monitor.sh.

1.

Press enter or click to view image in full size

Press enter or click to view image in full size

2.

Press enter or click to view image in full size

Press enter or click to view image in full size

Try ViewPageSource

3.

Press enter or click to view image in full size

Press enter or click to view image in full size

4.

Press enter or click to view image in full size

Press enter or click to view image in full size

Press enter or click to view image in full size

Press enter or click to view image in full size

Press enter or click to view image in full size

5.

Press enter or click to view image in full size

Press enter or click to view image in full size

6.

Press enter or click to view image in full size

Press enter or click to view image in full size

7.

Press enter or click to view image in full size

Press enter or click to view image in full size

Press enter or click to view image in full size

Press enter or click to view image in full size

then submited user flag

export TERM=xterm

find root

when i was sudo -l see give a full path then find root

Press enter or click to view image in full size