# DC-1: Drupalgeddon2, SUID binary to root shell

So I am going to be starting with this vuln machine. I'd say I'm starting to carve out a methodology with machines like this.

First of all, I'll start with a `netdiscover` to figure out the IP address of my DC1 machine. I run `sudo netdiscover 192.168.209.0/24` and the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/316a8f05-8bf2-4c5a-b50c-de2de1a42625.png align="center")

and my target IP address is `192.168.209.131`

The order for this will be

*   Recon - to observe all I can about the target with Nmap
    
*   Enumeration - to figure out more about the target and what specific vulnerabilities may be available
    
*   Weaponization - to get the exploits and tools which I would use to exploit the vulnerabilities
    
*   Exploitation - actually get access to the target
    
*   Things I learned - show some things I've learned that will help me become better at vulnerability testing
    

* * *

### Reconnaissance

This is my first phase and here I will be running a simple nmap scan to identify all that I can about my target.

I will be running `sudo nmap -sC -sV -O -A -T4 192.168.209.131` the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/b4e6ceb1-bc1a-4030-8303-098f7a119182.png align="center")

and next:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/ff444b5f-6417-474f-b350-e1a18f32160e.png align="center")

So from this scan I can see:

1.  Port 22 - OpenSSH 6.0p1 with Debian 4+deb7u7 (protocol 2.0) ------*I will do more research on this later*
    
2.  Port 80 - http - Apache httpd 2.2.22 on Debian
    
    *   http-title: says 'Welcome to Drupal Site (Drupal Site)'
        
    *   http-robots.txt - worth looking at
        
    *   lots of files and directories here
        
    *   http-generator - Drupal 7 (http:// drupal.org)
        
    *   http-server-header - Apache/2.2.22 (Debian)
        
3.  Port 111 - rpcbind
    
4.  MAC address - 00:0C:29:C5:89:1A
    
5.  Running - Linux 3.x
    
6.  OS details -- Linux 3.2 - 3.16
    

I'm writing a bit more details because, in an actual pentesting engagement, you may never know what detail will be useful, so you need to get as much information as possible. I think that's all the details for now.

Side note: *running* `nikto -h http://192.168.209.131` *albeit slow might actually prove to be a better option than Nmap, because it does a lot more, and shows you the results of http requests sent to the endpoints found in the Nmap scan, and it also shows you possible CVE's and exploits per endpoint. So definitely very handy.*

### Enumeration

So I'm currently ignoring port 22 and starting out with Port 80, since HTTP is easier to deal with for now. Typing in my target IP in Firefox return a webpage:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/acf1466b-5b9e-4c83-bb54-784a5809a9be.png align="center")

attaching `/robots.txt` to the IP address in the URL bar give me the robots.txt file

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/7d56b5a7-2435-4f81-9ff1-024be4b79eef.png align="center")

Nothing useful here, none of the directories can be reached, I keep getting this when I try to open them:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/d30678cf-ed6d-4563-b4b8-722cd9f13b31.png align="center")

From observing the site though it seems it should be vulnerable to SQLi. I mean there's login forms everywhere, and the robots.txt file is spilling too much information. I guess I'll need to go back and do a proper recap and study of SQL injections. This would have been pretty sweet....

Another possible vulnerability will be remote code execution, for the same reason, forms and input fields.

### Weaponization

So now I'm moving on to figure out any exploits for Apache 2.2.22 on `searchsploit` or anything I can get on `Drupal 7` whatever that is.

Searching `searchsploit` for Apache 2.2.22 with the command: `searchsploit apache 2.2.22` gives:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/56070e22-af82-453e-8bd4-d2df5f90d0a3.png align="center")

While doing the same for `Drupal 7` with the command `searchsploit drupal 7` gives:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/b5a56a9b-0644-43a9-a09d-0ab43ba4872d.png align="center")

which is quite a large number of vulnerabilities.

Going over the whole list again with a focus on the exploits for version 7 and below, I noticed a recurring exploit having both a Metasploit version and a regular Python Script for it. The `Drupalgeddon` as shown here:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/f878a36c-2a5f-4bc9-9d24-58bb93f97104.png align="center")

I guess this confirms my earlier assumptions about SQL injection and remote code execution, because most of the exploits here are related to those two. This backs up my need to study more of these two without using already made tools or exploits. `Portswigger` academy here I come or maybe `HackTheBox` or `TryHackMe`? Dunno

Why am I even thinking aloud? lol

So next, I'm going to copy it to my current DC1 lab folder with: `searchsploit -m /exploits/php/webapps/34992.py` and the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/bcf195ae-1aa2-47e6-bde8-9144b664faf8.png align="center")

a simple `ls` should show the file in our current directory.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/e07ec0fd-a395-471b-bc2b-2b87e9038d59.png align="center")

And now, I'll `cat` out the contents of the file and use `head` to get the first few lines, so I can know how to run the file.

`cat 34992.py | head -20` returns:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/c4e11863-7177-4458-82c0-d21d51145fbf.png align="center")

so no exact way to run it, means I'm running the `python` file as is. I run: `sudo python2 34992.py` and the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/c74de43c-dda3-490d-9df4-166e3cf88e89.png align="center")

and the rest of it is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/17b2ff90-cada-4ddc-a8c7-b6087ef62aca.png align="center")

so there you have it, the way to run our tool. It also includes a precise explanation of what the tool does, as it allows the attacker to create a new admin user via sql injection

The reason I used `python2` is because I found out that just running `python 34992.py` would return a syntax error and since I know it's coming from the fact that Python has done some syntax upgrade from Version 2 to the current Version 3. I just had to downgrade and it worked.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/a2f5a9e7-e6ea-4090-8897-f1e2cdb29a84.png align="center")

*side note: I think I'm actually going to go back and try out every other exploit on that list that is related to* `Drupal 7` *because I actually want to experience working with different attacks and different attack vectors. Get to understand how they work as well*

### Exploitation

Now I'm ready to use my tool to create a new admin user. I run the command:

`sudo python2 34992.py -t http://192.168.209.131 -u k4m1 -p k4m1n073`

the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/7a7e856e-e5e0-46ba-839a-22aec76f65f9.png align="center")

and then I go to my browser and open the url (or you can just hold down CTRL and click on the link in the terminal to automatically open it in the browser).

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/4bbdd40f-c193-400e-b836-7897d01e4884.png align="center")

after logging in, here's what I see:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/c4d5811e-8eb7-49d0-85e6-05b84b92385e.png align="center")

Notice the extra tabs at the top nav bar.  
If you open the dashboard, you'll see the other users and admins, and from there you can access their content or manage their accounts.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/7e6e3ac0-9144-45e8-9c1c-2562efd6217a.png align="center")

snooping into `flag3` shows an unpublished post, telling me that there are flags in the system, so I guess that's something to start looking around for.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/588e6eb2-587b-4407-ad05-664daf8ec778.png align="center")

So I go ahead and change Fred's password from the settings and log in to his account, to check if there's anything important hiding there.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/0832a8a9-f6fc-4f06-b441-bcc30c45f812.png align="center")

Nothing to see here, so I log back out and into my admin account I created, `k4m1` and continue snooping around. I finally found the correct `Drupal 7` version to be `Drupal 7.24` in the admin page:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/d34dcbfb-1f54-4d05-92df-6c4861b2d940.png align="center")

Since I can't really find anything more, I'm switching over to `Metasploit`

I run `sudo msfconsole`

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/1a09dadf-de28-42c4-b8bd-7a192094e84a.png align="center")

cool stuff, I always love the banners. next I search for all the exploits with the keywords `Drupal` so I can see what exploits I can run on my target.

I run `search drupal` and the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/79ace546-a34f-4a39-9d23-336a50112304.png align="center")

Looking down this list, I see an option for Drupal 7.0 - 7.31 for form-cache PHP injection. And I choose to go with it. *I might try the others out later though but not in this, don't want to get this too long*

Next I select that exploit with `use 17` and then I proceed to set the target IP as `RHOSTS` and my IP as `LHOST` and finally I `run`

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/317e5e17-1b4a-414f-8b51-a1c4e5819fba.png align="center")

Since I didn't set a payload to be used, Metasploit automatically defaulted to the php reverse tcp shell (need to do more study on this)

I run `ls` to get a list of all the documents in the server. I see a `.gitignore` here and I think it looks interesting. I'm going to check it out.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/9c55cdca-e523-45d8-af64-a0253cec0232.png align="center")

This means `nano` is not installed in my target so I switch to the regular unix command `cat` to get the content of the `.gitinore` file.

Looking through the list again, I notice a file called `flag1.txt` and I remember seeing a `flag3` file When I logged in to `Drupal` earlier.

opening it up with `cat flag1.txt` gives:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/052a4df3-ee52-497e-b9ab-efe70d867bec.png align="center")

and now I'm assuming the clue to the next flag is hidden in this piece of text. So I'm going to look for the config file next.

I run `cat web.config` to check what's in it, since it's the only obvious config file here. And here's what I got:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/39f6093f-2d90-47dc-9bed-6857236561bc.png align="center")

Sorry about the tiny font. I had to make sure to capture all I could. Now I'm confused. There seems to be no bit of actionable knowledge here, only bits of rules for formatting the way data is processed by the website.

So I was confused and went online to do a bit of research, then I found out I was looking at the wrong config file. Apparently `web.config` is an **IIS (Windows/.NET)** configuration file and it has nothing to do with `Drupal` at all. So I found out that the right config file should be a `settings.php` file.

To find it I use: `find / -iname "settings.php" 2>/dev/null` and the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/fe7f238a-19bd-43b5-a57a-bc45c6cf4c6c.png align="center")

Now the reason for this problem is because I am in a `Meterpreter` session and not a regular `Linux` shell, so not all `Linux` commands work here.

To be able to run `Linux` commands, I need to drop into a real system shell. I simply run `shell` in `meterpreter` and get a proper shell running.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/2843f6c3-3ad6-4036-a6b5-38f0fe9cd0a3.png align="center")

Then I proceed to go back to my `find` command, and the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/31791813-d6ce-45cb-8ae4-4239b608dda2.png align="center")

Now I have to `cat` the contents of the file to see if it's my flag.

I run: `cat /var/www/sites/default/settings.php` and the result is:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/15e85cd9-21ad-4a37-992d-b8293bac87d1.png align="center")

These are the first few lines of the file (there's a lot of stuff in this file including the `drupal` hash salt for some reason)

Now I have successfully gotten my second `flag`.

And now, I've gotten the name of a database and the username and password as well. I've also gotten the type of database which is `mysql`.

Next I try to use `mysql` to login to the db and see the contents:

running `mysql -u dbuser -p R0ck3t drupaldb` does not return anything so I move on. Trying to find out what's going on. Again looking online shows me that nothing is wrong and `mysql` is simply dropping me into it's own shell, so that's why I'm not seeing any responses and I simply need to paste in the `sql` command.

I simply went ahead and modified the `mysql` command to include the `sql` after one too many errors. The final command was: `mysql -u dbuser -pR0ck3t drupaldb -e "SELECT name, pass FROM users;"` It returned:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/b040a478-3ad5-4b34-a284-c28aa17c68f1.png align="center")

It's showing all the hashes for each of the accounts in the system, remember when I created `k4m1`? Not that I think I need any of these accounts right now though.

A quick search online (with google) shows that this is a SHA 512 hash that hash thousands of iterations to make hash cracking almost impossible and require an unreasonable amount of hardware processing resources.

Although in a real system this can be documented as a `confirmed DB access` which allows the attackers to identify app-layer accounts.

Now I'm going back to `flag2`'s text to see if I can get another hint to the next flag. *seeing as* `flag3` *has already been found since the beginning*.

On a second thought, I just went back to review what `flag3` says and it's talking about `PASSWD` and `shadow`. So now, seeing that I've got shell, I might as well check `/etc/passwd` and `/etc/shadow`

running `cat /etc/shadow` returns an error:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/b8924a60-b4d9-4d38-918a-faf01d382fdd.png align="center")

kind of expected to be honest since I'm not root or something.

running `cat /etc/passwd` returns:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/03c4c161-144d-4293-b6b8-cfe9625b35e0.png align="center")

And there we have it at the end of the file, our 4th flag, `flag4`, currently hiding as a user in the `Linux` system. It also happens to be the only user with a `/bin/bash` shell and a `/home` directory.

Now I simply need to connect to this guy via trusty old `SSH` and see what it's hiding. I'm going to try using the password `'R0ck3t'` which I got as the `db` password in `flag2`.

I run: `ssh flag4@192.168.209.131` but I get an error:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/4837f8a9-a1c8-4894-9d08-5c5c2dba5215.png align="center")

and so to fix that I add something to bypass the host key verification.

Now I run `ssh -o StrictHostKeyChecking=no flag4@192.168.209.131` and I get the same error. well something similar

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/584292c8-8e71-4ce4-8952-362e2d7f5b08.png align="center")

I realized it's because of the shell, since it's a shell on the target, so now I have to open a regular `Kali` terminal to try the `SSH`.

Now I'm trying the last `SSH` command I used in my own terminal, and here's what happens:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/98247386-1414-45c0-a975-925a30064888.png align="center")

Turns out `R0ck3t` is not the password to the account as well, so now I've got to figure that out.

I'm going to try to brute force the password using `hydra` and the regular `rockyoutxt` wordlist.

I run: `hydra -l flag4 -P /usr/share/wordlists/rockyou.txt ssh://192.168.209.131`

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/0d76dcba-2322-4112-b34d-521d7106b2d5.png align="center")

Our password is: `orange`

Now I have to try to login via `SSH` again.

running `ssh -o StrictHostKeyChecking=no flag4@192.168.209.131` gives me:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/66bdf242-e6f3-4272-85c9-8f4e086f7adc.png align="center")

I'm in! (*finally get to say that lol*)

A quick `ls` reveals a `flag4.txt` file. looking into the file with `cat` I see:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/d3b6dba9-2776-411a-a9d7-c8d3746e498a.png align="center")

It genuinely feels like this machine is playing with me and my feelings at this point. Now I'm going to check out the `/etc/passwd` file again for root. See if it's really "easy" as the flag says.

It shows:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/cad8cab1-0668-48d6-af51-b04062df0d8c.png align="center")

so now I'm going to terminate my connection to `flag4` and try to brute force the `root` password, though I doubt it would be this easy. Also I just realized I was wrong and `flag4` wasn't the only user with `/bin/bash` shell, `root` does too.

I run: `hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.209.131` and the result is:

nothing, because it never finished running. It was taking so long and it's a compute issue. Compute cost is a very important factor when it comes to brute forcing because it really determines how fast you can get results (*i.e. perform the numerous iterations*)

Now I'm going to find other ways to figure out what's going on.

I asked my good friend @ sh4q.lol and here's what he said to me:

> if you are currently in check for things like suid permission, and all that maybe only root can run, or check your netstat with normal ss -tulpn to check for things running on the network and all, maybe docker containers or maybe an sql server and all

A bit of research online, and I found GTFObins. A site where I can find shell commands, based on what binaries are in a system.

To check the binaries here, I run: `find / -perm -4000 -type f 2>/dev/null`

which gives me:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/ca2f37d9-d29f-43a0-b42c-8fff2442e17f.png align="center")

showing several binaries here. I go to https://gtfobins.org/ and search for these binaries to see what I can find.

I ran through the list on GTFObins, but nothing was working, and some of the binaries here weren't even on the site. I was almost giving up when I stumbled on `find`. initially it didn't work, as there was an error from one of the parameters.

The command was: `find . -exec /bin/bash -p \; -quit` which gave:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/71e236e4-0a85-4b33-b0d3-a019e7b85f0b.png align="center")

A little research showed it was because I was trying directly with `/sh` for shell and instead should have gone for `/bash`.

So now I run: `find . -exec /bin/bash -p \; -quit`

which gives me:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/fc064fd3-4819-4def-98b0-d6af5dc042c8.png align="center")

It drops me into a bash shell instantly, and I ran `whoami` to confirm if I was `root`. This was a success and it has taught me something, that sometimes the secret to success might just lie in changing some parameters in a command.

Now I need to look around for the flag.

I go to the root directory, and list out all the files in it.

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/7c5a4fa3-202b-42b9-bafd-3864f8a3222d.png align="center")

I snoop around the different directories and find nothing interesting until I get to `/root`.

Here's what I found:

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/249f86fd-6bb3-4e2b-9193-39a0c57959c4.png align="center")

Niceee.

Turns out this is the last flag here, so I guess this machine has come to an end.

Here's the content: `cat thefinalflag.txt`

![](https://cdn.hashnode.com/uploads/covers/6403a1ce6cc7b7a22094d47d/b6be1f74-4752-4065-83a1-46f0acb9faae.png align="center")

* * *

# Things I've learned from this machine

1.  Try to enumerate as much as possible. You'd never know where the door is or what keys might open the door, so just keep trying.
    
2.  Do a lot of research. Sometimes the answer to a problem might be documented online, so save yourself the stress and just look it up (AI helps a lot now)
    
3.  If some commands don't work, then you're not in a regular shell. Try to check for that.
    
4.  Pay attention to the little details. Sometimes the key vuln may be at the end or middle of a line of text. Try to read between the lines and question every detail.
    

*// K4M1\_n0\_73*