~/louizi
VulnHubEasy

VulnHub: DC-1

Drupalgeddon2 (CVE-2018-7600) gets an in-memory shell via Metasploit, then a SUID find binary hands over root through a one-line GTFOBins exploit.

Nmap Scan

Enumeration starts with an aggressive scan to identify open ports and service versions:

sudo nmap -sV -sC -p- 192.168.11.100 -o nmap.txt

nmap scan results

Four ports open:

  • 22 (SSH)
  • 80 (HTTP, Apache 2.2.22)
  • 111 (RPCbind)
  • 51456 (unassigned)

Web Server Enumeration

Port 80 shows a standard-looking site:

Drupal login page

Identification confirms it’s running Drupal.

Directory Fuzzing

ffuf -u http://192.168.11.100/FUZZ -w /usr/share/wordlists/dirb/big

Fuzzing didn’t turn up much, so robots.txt is worth a manual check instead:

robots.txt contents

Vulnerability Identification

Inspecting the source and response headers confirms the target is running Drupal 7, notoriously vulnerable to Drupalgeddon2 (CVE-2018-7600):

Drupal version confirmed in page source

Initial Access: Drupalgeddon2

msfconsole has a ready-made module for this:

msfconsole banner

searching for drupal exploits

After selecting and configuring the exploit, it lands a shell:

exploit configured and run, meterpreter session opened

Shell Upgrade

Upgrading to a stable Python PTY shell for better interaction:

python -c 'import pty; pty.spawn("/bin/bash")'

meterpreter shell upgraded to a PTY

Post-Exploitation & Enumeration

A quick check for cron jobs or anything unusual doesn’t turn up anything interesting:

checking /etc/crontab

SUID Binaries Discovery

Binaries with the SUID bit set are the next stop — reliable privilege-escalation targets:

find / -perm -u=s -type f 2>/dev/null

list of SUID binaries found

Privilege Escalation: SUID find

find is on that list — and it has an -exec flag that runs arbitrary commands with whatever permissions the binary itself holds. Since its SUID bit is set, anything run through -exec inherits the file owner’s permissions: root.

GTFOBins entry for find's SUID privesc

The GTFOBins pattern for this is a single line:

find . -exec /bin/sh -p \; -quit

root shell obtained via find's SUID bit

UID vs EUID

Linux distinguishes between the real user (UID) and the effective user (EUID) a process runs as:

  • uid=33(www-data) — who we actually are, the web server user
  • euid=0(root) — the identity the system uses when executing our commands

Because find “borrows” root’s authority via its SUID bit, the spawned shell inherits it — every action from here on is treated as if root performed it.

Final Flag

The flag is sitting in /root:

root directory listing showing the flag file

Takeaways

  • A single unpatched CVE (Drupalgeddon2) was enough for a full remote shell — Metasploit already had a working module, no custom exploit code needed.
  • robots.txt was more useful here than active fuzzing: it listed exactly the paths worth checking, for free.
  • The privilege escalation wasn’t a vulnerability in find itself — it was a misconfiguration (SUID set on a binary with a documented, intentional command-execution feature). Checking SUID binaries against GTFOBins is one of the highest-value five minutes in any Linux privesc.