Armageddon — HTB Writeup | The Hack Sparrow

Executive summary — Armageddon is an Easy Linux box on CentOS 7 that opens with Drupalgeddon2 (CVE-2018-7600), an unauthenticated RCE in Drupal 7. From the resulting apache shell we read MySQL credentials out of settings.php, dump Drupal's users table and crack brucetherealadmin's hash to SSH in. The final escalation abuses a misconfigured sudo rule (NOPASSWD: /usr/bin/snap install *) by packaging a malicious snap whose install hook runs as root. A Drupalgeddon2 → settings.php → MySQL → cracked hash → SSH → sudo snap install → root path.

Platform	Hack The Box
Operating system	Linux — CentOS 7 (Apache 2.4.6 + PHP 5.4.16)
Difficulty	Easy
Status	Retired
Target IP	`10.129.48.89`

Attack map

[80] Drupal 7 (CentOS 7, Apache 2.4.6, PHP 5.4.16)
   │  CVE-2018-7600 (Drupalgeddon2) — Forms API property injection
   │  via form_build_id → unauth RCE → apache
   ▼
[FILE]  sites/default/settings.php → cleartext MySQL credentials (drupaluser)
   │  mysql -u drupaluser drupal → users table → brucetherealadmin's Drupal 7 hash
   ▼
[HASH]  $S$... (Drupal 7, salted SHA-512) → hashcat -m 7900 + rockyou → booboo
   ▼
[SSH]  brucetherealadmin : booboo  (user.txt)
   │  sudo -l → NOPASSWD: /usr/bin/snap install *  (unrestricted wildcard)
   ▼
[ROOT]  malicious snap (fpm) with an install hook → reverse shell as root (root.txt)

1. Reconnaissance

We add the box to /etc/hosts and run a full port scan:

echo "10.129.48.89 armageddon.htb" | sudo tee -a /etc/hosts
nmap -sC -sV -p- armageddon.htb

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.6 (CentOS) PHP/5.4.16

CentOS 7 with Apache 2.4.6 and PHP 5.4.16 (EOL for years) already points to an unmaintained stack. We confirm the CMS with curl:

curl -s http://armageddon.htb/ | grep -i drupal

The <meta name="Generator" content="Drupal 7 …"> tag and robots.txt (with Drupal's typical /modules, /themes, /sites paths) confirm Drupal 7, vulnerable to Drupalgeddon2 if unpatched.

Resumen ejecutivo — Armageddon es un Linux Easy sobre CentOS 7 que arranca con Drupalgeddon2 (CVE-2018-7600), una RCE sin autenticación en Drupal 7. Desde la shell como apache se leen las credenciales de MySQL en settings.php, se vuelca la tabla de usuarios de Drupal y se craquea el hash de brucetherealadmin para entrar por SSH. La escalada final abusa de una regla de sudo mal configurada (NOPASSWD: /usr/bin/snap install *) empaquetando un snap malicioso cuyo hook de instalación se ejecuta como root. Recorrido Drupalgeddon2 → settings.php → MySQL → hash crackeado → SSH → sudo snap install → root.

Plataforma	Hack The Box
Sistema operativo	Linux — CentOS 7 (Apache 2.4.6 + PHP 5.4.16)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.48.89`

Mapa del ataque

[80] Drupal 7 (CentOS 7, Apache 2.4.6, PHP 5.4.16)
   │  CVE-2018-7600 (Drupalgeddon2) — inyección de propiedades en la Forms API
   │  vía form_build_id → RCE sin auth → apache
   ▼
[FILE]  sites/default/settings.php → credenciales MySQL en claro (drupaluser)
   │  mysql -u drupaluser drupal → tabla users → hash Drupal 7 de brucetherealadmin
   ▼
[HASH]  $S$... (Drupal 7, SHA-512 salteado) → hashcat -m 7900 + rockyou → booboo
   ▼
[SSH]  brucetherealadmin : booboo  (user.txt)
   │  sudo -l → NOPASSWD: /usr/bin/snap install *  (wildcard sin restricción)
   ▼
[ROOT]  snap malicioso (fpm) con hook install → reverse shell como root (root.txt)

1. Reconocimiento

Añadimos la máquina a /etc/hosts y lanzamos un escaneo completo de puertos:

echo "10.129.48.89 armageddon.htb" | sudo tee -a /etc/hosts
nmap -sC -sV -p- armageddon.htb

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.6 (CentOS) PHP/5.4.16

CentOS 7 con Apache 2.4.6 y PHP 5.4.16 (EOL desde hace años) ya apunta a una pila sin mantenimiento. Confirmamos el CMS con curl:

curl -s http://armageddon.htb/ | grep -i drupal

La etiqueta <meta name="Generator" content="Drupal 7 …"> y el robots.txt (con las rutas típicas /modules, /themes, /sites) confirman Drupal 7, vulnerable a Drupalgeddon2 si no está parcheado.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.