Capture The Flag
  • 🏠 Home
  • CTF 2024
    • 🖥INTIGRITI 2024
      • Warmup - Babyflow
      • OSINT - Bob L'éponge
  • CTF 2022
    • 🖥 ROOTCON 16 Pre-Qualifier
      • 1️⃣ Easy 300: Illusive Mind with Illusive Thoughts
      • 2️⃣ Easy 300: Hack and Take a Break
    • 🖥 HTB Cyber Apocalypse 2022 Intergalactic Chase
      • 1️⃣ Web 300: Kryptos Support
      • 2️⃣ Web 300: BlinkerFluids
  • CTF 2021
    • 🖥 ROOTCON 15 CTF
      • Exploitation 4
      • Exploitation 6
      • Web 200
    • 🖥 HTB Business CTF 2021
      • Time
      • NoteQL
  • CTF 2020
    • 🖥 ROOTCON RECOVERY MODE
      • Forensics (Warm Up)
      • Web (Wizardry)
Powered by GitBook
On this page
  1. CTF 2021
  2. 🖥 ROOTCON 15 CTF

Exploitation 6

PreviousExploitation 4NextWeb 200

Last updated 2 years ago

This challenge requires us to get shell access to the server.

Based on our enumeration using Ridgebot, one of the vulnerabilities of the server is Shellshock Remote Code Execution (CVE-2014-6271).

Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka 'ShellShock.'

I use ngrok since I don't have any VPS to create a tunnel to my kali machine.

I replace the payload with one-liner reverse shell

I prepare my netcat listener, then I hit enter then I got a reverse shell connection

Inside the server, I found the image which contains the flag

Flag: RC15{sXpbTeFkvtXALSTpT2Fd866774kA5kzp}