https://maxisfront.me/en/tags/drupal/Recent content in Drupal on MaxisFrontHugoenWed, 15 Jul 2026 10:16:52 -0600https://maxisfront.me/en/posts/writeup-dc-1-vulnhub/Mon, 16 Mar 2026 00:00:00 -0600https://maxisfront.me/en/posts/writeup-dc-1-vulnhub/<blockquote> <p>All rights reserved by the Drupal organization</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Service identification <code>Drupal 7</code> on port 80.</li> <li>Exploitation of the <code>CVE-2018-7600</code> to gain access (Drupalgeddon2).</li> <li>Exploiting SUID via the <code>find</code> to escalate to root.</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine.</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port scanning and CMS enumeration</li> <li>Searching for and using critical CVEs</li> <li>Use of basic GNU/Linux-based commands</li> <li>Exploitation of vulnerable SUIDs</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>arp-scan</li> <li>ping</li> <li>nmap</li> <li>python3</li> <li>nc</li> <li>find (SUID)</li> </ul> <hr> <h2 id="scanning-and-vulnerability-analysis">Scanning and Vulnerability Analysis</h2> <p>First, we analyzed our local network using the <code>arp-scan</code>, specifying our network interface. The command used was:</p>