10.11.1.71

cgi bin - shellshock + Pwnkit

Enum host,

Only two ports open.

Find some cgi-bins

run nikto

Seems vulnerable to shellshock, lets try

Make sure its vulernerable! It was a bit iffy about the params.

Found a python script with searchsploit

Also thought it would be fun to exploit manually:

Next I ran linpeas, it found a definitive results for PwnKit

Had trouble building using make as cpp1 was not found. Had to `export PATH` on victim machine, rebuild and then got shell!

Offensive Security's Guide To AlphaUserManual.wiki

http-shellshock NSE Script

Exploiting Shellshock Manually

GitHub - arthepsy/CVE-2021-4034: PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)GitHub