Bastard — HTB Writeup | The Hack Sparrow

Executive summary — Bastard is a Medium Windows box with a classic chain: unpatched Drupal 7 falls to Drupalgeddon2 (CVE-2018-7600), an unauthenticated RCE that gives a command prompt, but only as the limited IUSR user. Uploading nc.exe via certutil yields a real reverse shell (user flag). systeminfo reveals a Windows Server 2008 R2 with zero hotfixes — a direct candidate for a kernel exploit: MS15-051 (CVE-2015-1701), shared over SMB to avoid permission issues, gives execution as SYSTEM.

Platform	Hack The Box
Operating system	Windows Server 2008 R2
Difficulty	Medium
Status	Retired
Target IP	`10.129.26.9`

Attack map

[1] Recon -- 80/tcp http -> unpatched Drupal 7
        |
[2] Drupalgeddon2 (CVE-2018-7600) -- unauthenticated RCE -> drupalgeddon2>> prompt
      but only as nt authority\iusr, no real interactive shell
        |
[3] certutil -urlcache -- downloads nc.exe (native tool abuse) ->
      real reverse shell as IUSR  ->  user.txt
        |
[4] systeminfo -- Windows Server 2008 R2, Hotfix(s): N/A (unpatched)
        |
[5] MS15-051 (CVE-2015-1701) -- kernel exploit; shared over SMB
      (impacket-smbserver, avoids disk-write permission issues)
      +-> ms15-051x64.exe runs a second nc.exe as SYSTEM  ->  root.txt

1. Initial enumeration

nmap -sC -sV -p- 10.129.26.9 -oN nmap_bastard.txt

The most interesting port found is 80/tcp:

80/tcp open  http

Browsing to http://10.129.26.9, the web application is Drupal.

Resumen ejecutivo — Bastard es una Medium de Windows con una cadena clásica: Drupal 7 sin parchear cae ante Drupalgeddon2 (CVE-2018-7600), un RCE no autenticado que da un prompt de comandos, pero solo como el usuario limitado IUSR. Subiendo nc.exe vía certutil se consigue una reverse shell real (user flag). systeminfo revela un Windows Server 2008 R2 sin ningún hotfix — candidato directo a un exploit de kernel: MS15-051 (CVE-2015-1701), compartido por SMB para evitar problemas de permisos, da ejecución como SYSTEM.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2008 R2
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.26.9`

Mapa del ataque

[1] Recon -- 80/tcp http -> Drupal 7 sin parchear
        |
[2] Drupalgeddon2 (CVE-2018-7600) -- RCE no autenticado -> prompt drupalgeddon2>>
      pero solo como nt authority\iusr, sin shell interactiva real
        |
[3] certutil -urlcache -- descarga nc.exe (abuso de herramienta nativa) ->
      reverse shell de verdad como IUSR  ->  user.txt
        |
[4] systeminfo -- Windows Server 2008 R2, Hotfix(s): N/A (sin parches)
        |
[5] MS15-051 (CVE-2015-1701) -- kernel exploit; compartido por SMB
      (impacket-smbserver, evita problemas de escritura en disco)
      +-> ms15-051x64.exe ejecuta un segundo nc.exe como SYSTEM  ->  root.txt

1. Enumeración inicial

nmap -sC -sV -p- 10.129.26.9 -oN nmap_bastard.txt

El puerto más interesante encontrado es 80/tcp:

80/tcp open  http

Al acceder desde el navegador a http://10.129.26.9, la aplicación web es Drupal.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.