search

Armageddon

hashtag
Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.233

22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 82:c6:bb:c7:02:6a:93:bb:7c:cb:dd:9c:30:93:79:34 (RSA)
|   256 3a:ca:95:30:f3:12:d7:ca:45:05:bc:c7:f1:16:bb:fc (ECDSA)
|_  256 7a:d4:b3:68:79:cf:62:8a:7d:5a:61:e7:06:0f:5f:33 (ED25519)

80/tcp open  http    Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
|_http-title: Welcome to  Armageddon |  Armageddon
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
|_http-generator: Drupal 7 (http://drupal.org)
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt

Aggressive OS guesses: Linux 3.18 (96%), Linux 3.2 - 4.9 (96%), Linux 3.16 (95%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Oracle VM Server 3.4.2 (Linux 4.1) (93%), Linux 3.10 - 4.11 (93%), Linux 5.1 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 51.89 seconds

hashtag
80/tcp open http

Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)

Based on the Apache version, the host is likely running CentOS 7. The HTTP is hosting a Drupal 7 instance, and there’s a robots.txt file with a bunch of paths that I may want to check out in more detail.

WAP: broswer CMS: Drupal 7 Web servers: Apache HTTP Server 2.4.6 Programming languages: PHP 5.4.16 Operating systems: CentOS JavaScript libraries: jQuery 1.4.4

SOURCE CODE: browser view-source:http://10.10.10.233/

HEADERS:

BURP: browser

DIR:

SCANNERS:

/etc/hosts:

SUBDOMAIN FUZZ:

VHOSTS:

https://github.com/jobertabma/virtual-host-discovery arrow-up-right

SQLMAP:

I can try to create an account, but the process involves getting an email, which is typically not an option on HTB. I could try seeing if it will send to my IP, but the site throws errors that suggests it can’t send:

Version: In the Drupal GitHub, there’s a file at the root, CHANGELOG.txt. That file exists on Armageddon as well: https://github.com/drupal/drupal/tree/7.x arrow-up-right

http://10.10.10.233/CHANGELOG.txt arrow-up-right

Exploits: serachsploit shows a bunch of Drupal exploits (snipped out ones for non-7 versions):

There’s clearly a lot here. Drupalgeddon 2 and 3 both look like candidates.

hashtag
Shell as apache

RCE - Drupalgeddon2 Given the number of exploits and the fact that the quality in searchsploit can be a bit all over the map, I went to Google, and found this repo. I’ll look at exactly what it’s doing in Beyond Root, but the repo itself works great. Running it provides a prompt:

LogoGitHub - dreadlocked/Drupalgeddon2: Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)GitHubchevron-right

MSF:

hashtag
Shell as brucetherealadmin

Enumeration: Typically I go look at /home to see what other users are on the box and where I might want to pivot next. Interestingly, I can’t see anything in /home:

Looking at /etc/passwd, there’s one other account of interest, brucetherealadmin:

Drupal Config: apache doesn’t have access to much, so back into the web directory. There’s a settings.php file in /var/www/html/sites/default. It’s got DB creds:

I found an interesting file called settings.php inside /var/www/html/sites/default/ directory. which has contain mysql creads:

Database: Because my shell is a not in a PTY, I’ll have to run DB commands from the command line. Drupal creates a bunch of tables:

It’s giving us error so let's try another command of mysql:

It’s work let’s fetch the tables inside drupal database:

Now let’s dump the username and hashes inside users table:

Hash Crack: Now we have the hashes let's try to crack it.

We got the password for brucetherealadmin:booboo

SSH: This password works for SSH access:

hashtag
Shell as root

Enumeration: brucetherealadmin can run snap installs as root:

Malicious Snap Package:

Googling for maliocus snap packages led me to an article from 2019 about Dirty Sock. This isn’t the vulnerability here, but they used a malicious snap package to exploit the Dirty Sock exploit

Privilege Escalation in Ubuntu Linux (dirty_sock exploit)Shenanigans Labschevron-right

There’s a section in the Dirty Sock post that walks through how to create a snap package:

This github python script doesn't work in this case so in this script we only need the base64 string and then we decode the base64 string and save it in file.

Logodirty_sock/dirty_sockv2.py at master · initstring/dirty_sockGitHubchevron-right
PreviousPaperNextKnife

Last updated