Armageddon
Reconnaissance: NMAP
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.233
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
| 2048 82:c6:bb:c7:02:6a:93:bb:7c:cb:dd:9c:30:93:79:34 (RSA)
| 256 3a:ca:95:30:f3:12:d7:ca:45:05:bc:c7:f1:16:bb:fc (ECDSA)
|_ 256 7a:d4:b3:68:79:cf:62:8a:7d:5a:61:e7:06:0f:5f:33 (ED25519)
80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
|_http-title: Welcome to Armageddon | Armageddon
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
|_http-generator: Drupal 7 (http://drupal.org)
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
|_/LICENSE.txt /MAINTAINERS.txt
Aggressive OS guesses: Linux 3.18 (96%), Linux 3.2 - 4.9 (96%), Linux 3.16 (95%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Oracle VM Server 3.4.2 (Linux 4.1) (93%), Linux 3.10 - 4.11 (93%), Linux 5.1 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 51.89 seconds 80/tcp open http
Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
Based on the Apache version, the host is likely running CentOS 7. The HTTP is hosting a Drupal 7 instance, and there’s a robots.txt file with a bunch of paths that I may want to check out in more detail.
WAP: broswer CMS: Drupal 7 Web servers: Apache HTTP Server 2.4.6 Programming languages: PHP 5.4.16 Operating systems: CentOS JavaScript libraries: jQuery 1.4.4
SOURCE CODE: browser view-source:http://10.10.10.233/
HEADERS:
BURP: browser
DIR:
SCANNERS:
/etc/hosts:
SUBDOMAIN FUZZ:
VHOSTS:
https://github.com/jobertabma/virtual-host-discovery
SQLMAP:
I can try to create an account, but the process involves getting an email, which is typically not an option on HTB. I could try seeing if it will send to my IP, but the site throws errors that suggests it can’t send:
Version: In the Drupal GitHub, there’s a file at the root, CHANGELOG.txt. That file exists on Armageddon as well: https://github.com/drupal/drupal/tree/7.x
http://10.10.10.233/CHANGELOG.txt
Exploits: serachsploit shows a bunch of Drupal exploits (snipped out ones for non-7 versions):
There’s clearly a lot here. Drupalgeddon 2 and 3 both look like candidates.
Shell as apache
RCE - Drupalgeddon2 Given the number of exploits and the fact that the quality in searchsploit can be a bit all over the map, I went to Google, and found this repo. I’ll look at exactly what it’s doing in Beyond Root, but the repo itself works great. Running it provides a prompt:
MSF:
Shell as brucetherealadmin
Enumeration: Typically I go look at /home to see what other users are on the box and where I might want to pivot next. Interestingly, I can’t see anything in /home:
Looking at /etc/passwd, there’s one other account of interest, brucetherealadmin:
Drupal Config: apache doesn’t have access to much, so back into the web directory. There’s a settings.php file in /var/www/html/sites/default. It’s got DB creds:
I found an interesting file called settings.php inside /var/www/html/sites/default/ directory. which has contain mysql creads:
Database: Because my shell is a not in a PTY, I’ll have to run DB commands from the command line. Drupal creates a bunch of tables:
It’s giving us error so let's try another command of mysql:
It’s work let’s fetch the tables inside drupal database:
Now let’s dump the username and hashes inside users table:
Hash Crack: Now we have the hashes let's try to crack it.
We got the password for brucetherealadmin:booboo
SSH: This password works for SSH access:
Shell as root
Enumeration: brucetherealadmin can run snap installs as root:
Malicious Snap Package:
Googling for maliocus snap packages led me to an article from 2019 about Dirty Sock. This isn’t the vulnerability here, but they used a malicious snap package to exploit the Dirty Sock exploit
There’s a section in the Dirty Sock post that walks through how to create a snap package:
This github python script doesn't work in this case so in this script we only need the base64 string and then we decode the base64 string and save it in file.
Last updated