Shocker
Overview
Initial Foothold : Shellshock Vulnerability
Privilege Escalation : Access misconfiguration
Enumeration
Start with port scanning
Port Scanning
Port 80 was open and running webserver
Lets visit the webpage
Got some hint from name and picture that there may be shellshock vulnerability
If you want to learn more about shellshock vulnerability just google the name you will find tons of writeups for this
After running dirbuster we only got /cgi-bin/ directory
Start dirbuster scan in this directory with extension php,sh,rb
Got one file name user.sh lets visit the page
It started downloading the file
This confirms that there is a file in cgi-bin directory which we can access
Thats all required for exploiting shellshock vulnerability
Exploitation
Lets start exploitation of shellshock vulnerability
Will use curl for execution of cmds on the site
First get the content of /etc/passwd from the target webserver
Run the following command
Got the content of /etc/passwd file
Lets try to get reverse shell using the same
Run the following command and setup listener using netcat
Got the reverse shell back as shelly user
Privilege Escalation
Simply run sudo -l command
Here we can see that we can perl as root user
Lets see in gtfobins if we can escalate privileges using perl command
and we got
Using above command we can escalate to root user
That's all for this box
Good Bye :)
Last updated