# DC-1

Lets start with an nmap scan as always. I am running this machine in virtualbox with an isolated network.

nmap -A -p- 10.6.6.18\
Starting Nmap 7.93 ( <https://nmap.org> ) at 2023-06-04 10:07 PDT\
Nmap scan report for DC-1.cyber.range (10.6.6.18)\
Host is up (0.044s latency).\
Not shown: 65531 closed tcp ports (conn-refused)\
PORT STATE SERVICE VERSION\
22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)\
\| ssh-hostkey:\
\| 1024 c4d659e6774c227a961660678b42488f (DSA)\
\| 2048 1182fe534edc5b327f446482757dd0a0 (RSA)\
|\_ 256 3daa985c87afea84b823688db9055fd8 (ECDSA)\
80/tcp open http Apache httpd 2.2.22 ((Debian))\
|\_http-title: Welcome to Drupal Site | Drupal Site\
|\_http-generator: Drupal 7 (<http://drupal.org>)\
\| http-robots.txt: 36 disallowed entries (15 shown)\
\| /includes/ /misc/ /modules/ /profiles/ /scripts/\
\| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt\
\| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt\
|\_/LICENSE.txt /MAINTAINERS.txt\
|\_http-server-header: Apache/2.2.22 (Debian)\
111/tcp open rpcbind 2-4 (RPC #100000)\
\| rpcinfo:\
\| program version port/proto service\
\| 100000 2,3,4 111/tcp rpcbind\
\| 100000 2,3,4 111/udp rpcbind\
\| 100000 3,4 111/tcp6 rpcbind\
\| 100000 3,4 111/udp6 rpcbind\
\| 100024 1 35298/tcp6 status\
\| 100024 1 41056/udp6 status\
\| 100024 1 45049/tcp status\
|\_ 100024 1 49811/udp status\
45049/tcp open status 1 (RPC #100024)\
Service Info: OS: Linux; CPE: cpe:/o:linux:linux\_kernel\
\
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .\
Nmap done: 1 IP address (1 host up) scanned in 26.89 seconds<br>

Alright lets take a look at port 80

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FE1sRRhPEfzn6R8KDdTLq%2Fdc1.png?alt=media&#x26;token=d0649845-4787-4209-9d6a-f2156d482f7c" alt=""><figcaption></figcaption></figure>

Alright pretty standard drupal login page. Lets have a look at Wappalyzer

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2F4m3EGA02v5xISBH3VkNf%2Fdc2wap.png?alt=media&#x26;token=b380f0c2-d207-4bf9-a0cf-8fb08dfb7aa7" alt=""><figcaption></figcaption></figure>

Drupal 7. Fireup msfconsole and search for drupal 7 exploits.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FdGh83yVq1nhj3se3JaDd%2Fdcmsf.png?alt=media&#x26;token=4f5dbe2c-3fb2-4f02-a9a5-34a3691da587" alt=""><figcaption></figcaption></figure>

I tried 0 first but it didn't work. 1 was successful and I got a shell.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2Fr1mHwQJI4SXcfc4sbtTw%2Fflag1.png?alt=media&#x26;token=738b3ff9-dee6-46b0-a4a4-321ca21004b7" alt=""><figcaption></figcaption></figure>

Hmm ok. Lets have a look at the home directory.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2F4DyFxMZn62HBUvJO3QVZ%2Fflag4.png?alt=media&#x26;token=6fa94fb6-b2fa-4305-9788-e64bf489e486" alt=""><figcaption></figcaption></figure>

Well I skpped over the other flags (there are 5 on this machine). I ran linpeas.sh and saw that I could use find to gain root. And that's what I did. Low hanging fruit for the win!&#x20;

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FXIw0GtwMlGT7npHf3X0H%2Fpwd.png?alt=media&#x26;token=4bd1a929-44d8-44aa-b37a-9a84453d3eac" alt=""><figcaption></figcaption></figure>

&#x20;If you want to do some password cracking you can find some hashes in flags 2 and 3. Heres how to do it.

After poking around for flag2 I found it in settings.php

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FNh62EGO8Hw4eNSZevrJn%2Fsettings.png?alt=media&#x26;token=17816521-c4eb-4e6b-bd09-05d7b76e33fc" alt=""><figcaption></figcaption></figure>

Login to mysql

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2Fx6j17LebkCXM7orWl4nz%2Fmysql.png?alt=media&#x26;token=13d8f348-2918-4a5b-95c1-acfe27aba02f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FMQ9uqwXt1hr53TeGa3uZ%2Fdatabases.png?alt=media&#x26;token=baeb89d1-1ea9-49a2-a780-014ab494c526" alt=""><figcaption></figcaption></figure>

show tables produces a pretty long list. I went for users as that seemed pretty straight forward.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FjfNvL976S4S0CaQE76YR%2Fusers.png?alt=media&#x26;token=00718203-fe12-4cbc-aa8c-b14a429e1acd" alt=""><figcaption></figcaption></figure>

And we have two users. admin and fred along with their hashes. I used hashcat to crack both password hashes.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2F7Dbnuw7HkGrdYlyRlg6G%2Fadminhashcat.png?alt=media&#x26;token=34b79564-c82b-450f-bebe-9dbf81cdb52b" alt=""><figcaption></figcaption></figure>

You can use this password to login to the admin panel and read flag3.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FzwMJQKQqaEJwJUuBKpDx%2Fflag3.png?alt=media&#x26;token=1b5ee79b-3d94-40b1-b545-6c878f371cbe" alt=""><figcaption></figcaption></figure>

I went to <https://gtfobins.github.io/gtfobins/find/> and used this method to read /etc/shadow.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FP9HoyxEgu3IwxoZiDXJw%2Fetcshadow.png?alt=media&#x26;token=5e0e5f20-fe1f-4adb-a6e8-1e4eb38d604a" alt=""><figcaption></figcaption></figure>

I did try cracking roots hash but failed. However, the user flag4...well his password isn't so secure.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FDvGHObldrRNSy5GAmMof%2Fflag4.png?alt=media&#x26;token=4c22e639-0363-4fd5-92ed-ee313c89fe96" alt=""><figcaption></figcaption></figure>

With this you can login via ssh and read roots flag and gain root privilege.

<figure><img src="https://2271353664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mc4yoWnnXV8DO0WadPB%2Fuploads%2FA77XwCtCNLgaG6wvrvjx%2Froot.png?alt=media&#x26;token=ae1cb437-ffd6-4b71-aeaa-7c9adf6aa9fc" alt=""><figcaption></figcaption></figure>

This box is begginer friendly with some pretty basic enumeration. Once you gain initial access privilege escalation is just one command. Stay tuned for DC-2!