HTB Linux Easy: Shocker
Shocker is an Easy rated Linux machine on HTB.
HTB Linux Easy: Shocker
Nmap
Initial Foothold
HTTP
Use dirb for directory busting to find the cgi-bin endpoint. 
Enumerating the cgi-bin directory using ffuf, no scripts were found with the .cgi extension, however the .sh extension returned a result: user.sh. 
Since we know what script is in the /cgi-bin/ directory we can use it to get a reverse shell. For this we will use burpsuite and change our User-Agent to a reverse shell. 
Our nc listener should have turned into a shell. 
Priv Esc
Sudo -l reveals a binary that we can execute with sudo, use GTFObins to escalate to root. 
User.txt
Root.txt
PWNED!!!
Sources
This post is licensed under CC BY 4.0 by the author.