{"uuid": "bd4fc2a8-139c-4907-93dc-04b8a774ec69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-7600", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/27396", "content": "Hacking Articles|Raj Chandel's Blog\nArmageddon HackTheBox Walkthrough\n\nWe\u2019ll look at another one of HackTheBox machines today, called \u201cArmageddon.\u201d It is an easy box targeting commonly found threat of using outdated plugins. In this box, old and vulnerable version of Drupal is showcased. We\u2019d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology\u00b7 NmapVulnerability Analysis and Exploitation\u00b7 Drupalgeddon2 RCE exploit to gain user shellPrivilege Escalation\u00b7 Searching for mysql database credentials in default filesReconMachine\u2019s IP was 10.129.48.89. The first step was to run nmap\u2019s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A\u00a0 10.129.48.89https://blogger.googleusercontent.com/img/a/AVvXsEiIseJMMBSWNZIY_v8137CAhYplR3SCz5373lhxqSgZbTkFUrH_vTmX4-GRyivcJR2bU88jqe9wOEQS9qoRS9HvnABh17fCRNwHQM6voofL9NmLWOujHPOidqYq-bfyYgLE1cseZYn8kJzVtxM8RECvzA_zg7RwluCgn05YLuW1X9QSAOSccZAzeGC0FQ=s16000 On traversing the website on port 80, it seemed a CMS made website.Vulnerability Analysis and ExploitationWe knew that Drupal 7.X before 7.58 was vulnerable to various CVEs including CVE-2018-7600. Drupalgeddon2 exploit is developed to exploit Drupal\u2019s form API and exploits insufficient input validation. You can refer the original repo here.Privilege EscalationGladly Metasploit had this exploit in the framework, so we just used that and spawned an interactive shell. On checking the current directory we saw the site installation files with necessary permissions to let us view the content.use exploit/unix/webapp/drupal_drupalgeddon2A basic ls let us view contents.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T08:00:05.866187Z"}