Shocker Writeup
Shocker, while fairly simple overall, demonstrates the severity of the renowned Shellshock exploit, which affected millions of public-facing servers.
Vulnerability Exploited: GNU Bash - 'Shellshock' Environment Variable Command Injection (CVE-2014-6271)
System Vulnerable: 10.10.10.56
Vulnerability Explanation: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock."
Vulnerability Fix: The publishers of the Ability Server have issued a patch to fix this known issue. It can be found here: https://security.berkeley.edu/news/shellshock-gnu-bash-remote-code-execution-vulnerability-cve-2014-6271
Privilege Escalation Vulnerability: Insecure service configuration
Vulnerability Fix: You should always conform to the principle of least privilege and the concept of separation of privileges.
Severity: Critical
An initial nmap scan revealed the Apache version 2.4.18 running on port 8080.
The shocker main page is shown below:
Fuzzing the website find any existing directories.
The /cgi-bin/ directory gives a 403 ( You don’t have permission to access /cgi-bi/ on this server)
Enumerating more on the /cgi-bin/ directory and looking for files with extensions “sh” and “cgi”.
Getting back a bash script (user.sh) that contain the content as follow:
Identified an exploit for shellshock using searchsploit
Used an exploit from https://www.exploit-db.com/exploits/34765 and modified it as shown belo
Run the modified exploit
Received a reverse shell on port 9001 as shelly
user.txt
Run sudo -l command to determine what permissions the use shelly have.
Run a perl code using sudo to escalate the access.
root.txt
Last updated