From the people who brought you WHAT THE CTF, CyberGuider is please to present its official walkthrough of DC1:1 from VulnHUB. This system was a lot of fun and shows that simple misconfiguration can cause the system to be compromised. Here is how we started…
RECON PHASE
Of course with a NMAP scan, you know the standard flags -sC -sV -A -p-..yea regular stuff. Check out the output
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
| ssh-hostkey:
| 1024 c4:d6:59:e6:77:4c:22:7a:96:16:60:67:8b:42:48:8f (DSA)
| 2048 11:82:fe:53:4e:dc:5b:32:7f:44:64:82:75:7d:d0:a0 (RSA)
|_ 256 3d:aa:98:5c:87:af:ea:84:b8:23:68:8d:b9:05:5f:d8 (ECDSA)
80/tcp open http Apache httpd 2.2.22 ((Debian))
|http-generator: Drupal 7 (http://drupal.org) | http-robots.txt: 36 disallowed entries (15 shown) | /includes/ /misc/ /modules/ /profiles/ /scripts/ | /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt | /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt |/LICENSE.txt /MAINTAINERS.txt
|http-server-header: Apache/2.2.22 (Debian) |_http-title: Welcome to Drupal Site | Drupal Site 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100024 1 54200/tcp status | 100024 1 54610/udp status
54200/tcp open status 1 (RPC #100024)
MAC Address: 00:0C:29:16:4F:B3 (VMware)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 – 3.16 —Oh man….DirtyCOW
Let’s see what we have here on PORT 80…Drupal.
Once you’ve confirmed a target is running Drupal, it’s time to shift from passive discovery to active web reconnaissance. In this phase, open-source tools like Nikto and Gobuster become your go-to utilities for vulnerability scanning and server fingerprinting. Nikto quickly identifies known exploits, outdated components, and misconfigurations, while Gobuster systematically brute-forces directory structures to uncover hidden files, backup paths, and potential attack surfaces.
With initial scan results documented, your next step is extracting the robots.txt file—a foundational technique in Open-source intelligence (OSINT) and penetration testing workflows. Using either WGET or CURL, you can grab the file instantly:
wget http://192.168.66.130/robots.txt
# or
curl -O http://192.168.66.130/robots.txtDon’t treat robots.txt analysis as a formality. This seemingly harmless file often leaks disallowed directories, CMS-specific endpoints, staging environments, and administrative panels that can significantly accelerate a Drupal security assessment or ethical hacking engagement. Documenting these findings ensures repeatable, audit-ready reports for vulnerability management teams.
At this point, IT’S DROOPESCAN TIME! and its results displayed below:
Exploit Phase
And now for the exploit…
After researching this exploitation, I found a great tool on GITHUB called “Drupal 7 (CVE-2018-7600 / SA-CORE-2018-002) by PIMPS”. When assessing Drupal-based applications, one of the most critical vulnerability chains involves combining form manipulation with asynchronous endpoint exploitation. By chaining form poisoning on /user/password with payloads routed through Drupal’s /file/ajax endpoint, this vulnerability enables Remote Code Execution (RCE). During a controlled test against a susceptible system, the exploit successfully triggered unintended code execution. Here are the live results:
The payload successfully triggered unintended code execution within the framework’s serialization routines.
Contents of FLAG1.TXT…with a little CAT action.
This is good, now let’s get a reverse-shell. Check with the fellows at PENTEST Monkey Cheatsheet. Guess who found one that work. THIS GUY.
After finding the FLAG4 user and HOME directory, we found the next FLAG4.txt.
DCAU7 did a great job preparing this system with older Linux and misconfiguration for the attacker to have a path to privilege escalation (PRIVESC). Post-exploitation reconnaissance revealed the target runs Linux kernel 3.2.0-6-486 on a 32-bit Debian (i686) system. Verified via uname -mrs, this version is highly susceptible to the DirtyCOW privilege escalation (CVE-2016-5195), making kernel-level PrivEsc a reliable next step. Not so fast, DCAU7 wanted us to do more work than just compiling an exploit and running it against the system so DirtyCOW did not work in this instance. Perhaps this is NOT THAT EASY.
PRIVESC
Going back to the POST EXPLOIT recon data gather earlier and performing a few trials of other kernel exploits which failed, we find a file with SUID permission on the server and find that the “find” command has SUID bit set. Allowing us to used the “find” command as root privilege due to the sticky bit that is set (as root). Further search confirm it as shown below.
find / -perm -u=s -type f 2>/dev/null
My research uncovered this great article about Abusing SUDO (Linux Privilege Escalation) by Touhid Shaikh which explained the process and why it works. Getting a better understanding of this process, maybe the PRIVESC is not so hard. Here is the PRIVESC for this box. With one line of command line KUNGFU we were able to get ROOT.
WOOT WOOT
