Shocker - HTB - Key Points
August 3, 2022•93 words
- Open port on 80 and a 2222 which is actually an SSH over deeper inspection (detect the specific port using sV in nmap)
- Enumeration of the web server won't reveal much besides a cgi-bin directory, fuzzing for scripts returns a user.sh script
- We can try and exploit this with Shellshock, using the metasploit module exploit/multi/http/apache_mod_cgi_bash_env_exec. This gives us low privileged access on the box
- Running "id" we see our user is part of the lxd group, meaning we can immediately escalate to root privileges, as explained here
- Merry hacking ;)