pentesting-obioba

Black box pentesting: Shellshock (CVE-2014-6271) + Log4Shell (CVE-2021-44228). Root escalation. Executive and technical report

Pentesting Obioba — Security Audit (Black Box)

Project of the 360° Cybersecurity Bootcamp by The Bridge Digital Talent Accelerator (2025-2026).

🎯 Objective

Perform a security audit on a legacy server using black box methodology, simulating an external threat actor without prior credentials. The goal was to identify vulnerabilities that allowed unauthorized access and privilege escalation to full system control.

🧪 Environment

• Target: Obioba server (legacy database repository)
• Attacker: Kali Linux
• Methodology: Black box — no prior knowledge of infrastructure
• Environment: Controlled and isolated lab

🔁 Executed phases

1. Reconnaissance and enumeration

Identification of exposed services using Nmap with flags -sV -sC -p-. Discovery of three vectors of interest: SSH (port 22), Apache web service (port 8081), and Java/Nagios service (port 8080).

2. Vulnerability analysis

Web enumeration with DIRB to confirm /cgi-bin/ paths. Nessus scan of port 8080 revealed critical Log4Shell vulnerability with CVSS 10.0.

3. Exploitation — Shellshock (CVE-2014-6271)

Exploitation of vulnerable CGI script on port 8081 using Metasploit (apache_mod_cgi_bash_env_exec). Obtained shell as user www-data.

4. Privilege escalation — Log4Shell (CVE-2021-44228)

JNDI injection in HTTP headers on port 8080 using Metasploit (log4shell_header_injection). The Java service was running as root — total system compromise.

5. Executive report and mitigation plan

Documentation of impact on the CIA triad, risk analysis by criticality, and remediation plan with concrete deadlines.

🛠️ Tools used

🛡️ MITRE ATT&CK Mapping

📊 Result

Total server compromise in less than 3 hours. Both vulnerabilities are known and have had patches available for years — demonstrating the real risk of unmaintained legacy systems.

🔒 Confidentiality notice

⚠️ Detailed technical reports, screenshots, and project evidence are not published in this repository for confidentiality reasons with the educational institution (The Bridge Digital Talent Accelerator).

If you are a recruiter or industry professional and wish to see the full material (executive reports, PoC, screenshots, and mitigation plans), feel free to contact me:

📧 [email protected] 🔗 LinkedIn

⚠️ Disclaimer

This project was executed in an isolated lab environment for educational purposes. The documented techniques are aimed at improving defensive capabilities.

📧 Contact

Facundo Martín Fernández Otón · GitHub