> For the complete documentation index, see [llms.txt](https://ctf.laet4x.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.laet4x.com/ctf-2021/rootcon-15-ctf/exploitation-6.md).

# Exploitation 6

<figure><img src="/files/tZoFt5Bsb3lemY9zlTRV" alt=""><figcaption></figcaption></figure>

This challenge requires us to get shell access to the server.

Based on our enumeration using Ridgebot, one of the vulnerabilities of the server is **Shellshock Remote Code Execution (CVE-2014-6271).**

Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod\_cgi and mod\_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka 'ShellShock.'

I use ngrok since I don't have any VPS to create a tunnel to my kali machine.

<figure><img src="/files/TfVx5169IptBO1NcBE5q" alt=""><figcaption></figcaption></figure>

I replace the payload with one-liner reverse shell

<figure><img src="/files/GfhUJcoRqgAPOQfSiOKG" alt=""><figcaption></figcaption></figure>

I prepare my netcat listener, then I hit enter then I got a reverse shell connection

<figure><img src="/files/zHCiJye9YJ1WHVnzGiOE" alt=""><figcaption></figcaption></figure>

Inside the server, I found the image which contains the flag

<figure><img src="/files/sfjvW2u8aC25IJnv0lJv" alt=""><figcaption></figcaption></figure>

Flag: ***RC15{sXpbTeFkvtXALSTpT2Fd866774kA5kzp}***