HTB - Bastard
Getting Root:
Enumerating port 80 shows the box is running Drupal 7.54 which is vulnerable to remote code execution
After getting a low privilege shell, we escalate privilege to SYSTEM using MS10-059
Tools Used:
nmap, curl, windows-exploit-suggester.py, certutil
Nmap
Enumerating Port 80
Checking robots.txt
Checking CHANGELOG.TXT reveals the version of Drupal to be 7.54
Exploit
Found the following exploit for Drupal 7.54 on GitHub.
That confirms we have remote command execution
Getting a shell
Privilege Escalation
Windows Exploit Suggester
Got SYSTEM using MS10-059
Downloaded the exploit to the target
Got a shell with SYSTEM privileges
System Information
Another Way To Do the Box:
I tried running this exploit but keep getting errors at execution. For this exploit to work, you might need to install php-curl
From gobuster I was able to see /rest in the output. So I used curl to check it out.
With that information, I modified the php exploit as follows: ( I also had to modified a few syntax errors which basically needed to be commented out)
Running the exploit
Got two files
1. session.json 2. user.json
Login as admin
I used the Firefox plugin Cookie Quick Manager and added the cookie from the session.json file
Refresh the page http://10.10.10.9
After hitting refresh on the site, you should be logged in as Admin
Go to Modules and and enable PHP Filter
Scroll all the way to the bottom and click Save Configuration
Getting a reverse shell
Click on "Add Content"
Add "Basic Page"
Add your php code
Add a title, your PHP code and change the Text format to PHP code. Then scroll all the way to the bottom and click Save.
In my case, the PHP code I used is a webshell I got from GitHub. This webshell allows me to execute any commands on the target and even upload files such as the compiled binary for MS10-059 we used on method 1 and get a shell as SYSTEM.
Getting the reverse shell
Got a shell as SYSTEM
Last updated