OSCP Prep, DC-1 Proving Grounds Play

This is a great starter box for your hacking journey or one of the first boxes you study for the OSCP. I saw something very similar on the INE eJPT. Drupel API exploit: CVE-2018–7600, or Drupalgeddon2, was probably one of the most severe and wild exploits ever. So there are two ways to go about this box. However, let's pretend you are so close to finishing the OSCP with 60 points, but you only need 70 to pass. This is where using Metasploit comes in handy. The goal is to get 100/100, but to pass this beast of a test within 24 hours, you only need to pass that last box. You can only use Metasploit once on the test, but in this circumstance, use it. You only need those last 10–20 points to pass.

Enurmaration:

Starting with nmap, however, I’ll add what I saw because I ran whatweb during the scan.

nmap -sC -sV -p- --open $target -v 

Discovered open port 22/tcp on 192.168.52.193
Discovered open port 80/tcp on 192.168.52.193
Discovered open port 111/tcp on 192.168.52.193
Discovered open port 41720/tcp on 192.168.52.193

Sometimes the scans may take more than a moment, so I run whatweb. I learned that everything you really need to web enumerate within a time limit is whatweb and dirsearch.

http://192.168.52.193 [200 OK] Apache[2.2.22], Content-Language[en], Country[RESERVED][ZZ], Drupal, HTTPServer[Debian Linux][Apache/2.2.22 (Debian)], IP[192.168.52.193], JQuery, MetaGenerator[Drupal 7 (http://drupal.org)], PHP[5.4.45-0+deb7u14], PasswordField[pass], Script[text/javascript], Title[Welcome to Drupal Site | Drupal Site], UncommonHeaders[x-generator], X-Powered-By[PHP/5.4.45-0+deb7u14]

I already see that Drupal 7 can be compromised. After finishing the nmap scan:

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
| ssh-hostkey: 
|   1024 c4:d6:59:e6:77:4c:22:7a:96:16:60:67:8b:42:48:8f (DSA)
|   2048 11:82:fe:53:4e:dc:5b:32:7f:44:64:82:75:7d:d0:a0 (RSA)
|_  256 3d:aa:98:5c:87:af:ea:84:b8:23:68:8d:b9:05:5f:d8 (ECDSA)
80/tcp    open  http    Apache httpd 2.2.22 ((Debian))
|_http-title: Welcome to Drupal Site | Drupal Site
|_http-favicon: Unknown favicon MD5: B6341DFC213100C61DB4FB8775878CEC
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-generator: Drupal 7 (http://drupal.org)
|_http-server-header: Apache/2.2.22 (Debian)
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          41274/tcp6  status
|   100024  1          41720/tcp   status
|   100024  1          49941/udp6  status
|_  100024  1          54030/udp   status
41720/tcp open  status  1 (RPC #100024)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

With the same versions being recorded, I could search the internet, but let’s say I only had two more flags to pass, and I was that close to passing this test. Check Metasploit.

Now, there is an exploit we want, and that is number 1: the RCE. Could you use the GitHub repo here:

[embed]GitHub - dreadlocked/Drupalgeddon2: Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600… Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002) - dreadlocked/Drupalgeddon2github.com

[embed]GitHub - lorddemon/drupalgeddon2: Exploit for CVE-2018-7600.. called drupalgeddon2, Exploit for CVE-2018-7600.. called drupalgeddon2, - GitHub - lorddemon/drupalgeddon2: Exploit for CVE-2018-7600…github.com

Sure, you can use either of these, Ruby or Python. But in this case, we can stick with Metaspliot and get the points in under 20 minutes. Now show options:

Simple: need to add the rhosts IP address and send the full payload:

Got it, then it's just going to the /home folder and checking out what’s on the server:

PrivEsc:

Tip for this test: run commands manually before you go down a bad rabbit hole with Linpeas. Use that if you really can’t find anything andare struggling with the box. But in this case, I ran two commands and found the quick win:

Find is a very common SUID too, so on GTFObins:

find . -exec /bin/sh -p \; -quit

Oddly, this was the result of the first one:

Removed -p flag and success!

I am root!

So the goal here is not to overthink it. Regardless of the boxes, focus on the fundamentals and get quick wins. You don’t really need to take the eJPT, but doing this box will help with time management.

Here’s my video walkthrough:

[embed]

Thank you for reading! Also:

https://docs.google.com/spreadsheets/d/1BslpPR5cmj16NV-nIS2OGDN5w3WDE9K5OrgACMtyU14/htmlview#gid=0

I made my super list of boxes, links, YouTube channels, and tools you can reference. Still building out my GitHub repo for the oscp with notes and tools I've seen while studying. Let’s get after it.