DC-1 (VulnHub) — black-box penetration test, recon to root

Posted Aug 5, 2026

By Mikel Gonzalez

7 min read

Engagement type: Network penetration test (black-box, single host) Tester: Self-study lab (solo capstone) Date: 2026-07-31 Target: 192.168.56.103 (VulnHub DC-1), isolated host-only network 192.168.56.0/24 Attacker host: Kali Linux 192.168.56.102 Authorization: Self-owned lab VMs on an isolated, internet-less network. No third-party systems in scope.

1. Executive summary

A single web-server host on the internal lab network was assessed with no prior knowledge and no credentials (black-box). The host was fully compromised: starting from nothing but network access, the tester obtained a foothold through the public website and then escalated to complete administrative (root) control of the machine.

Two failures made this possible. First, the website runs a years-out-of-date content-management system (Drupal 7) with a well-known, unauthenticated flaw that let the tester run commands on the server without logging in. Second, once on the machine as a low-privilege web user, a misconfigured system file permission allowed a routine command to be abused to become root.

In business terms: an anonymous attacker on this network could take total control of the web server and all of its data, with no username or password required. The two weaknesses compound — the first gets an attacker in, the second makes them administrator.

The root cause is obsolete, unpatched software plus a local hardening error, not a single bug. Remediation requires updating/replacing the platform and correcting the file-permission misconfiguration, then adopting a baseline hardening and patch-management standard.

Overall risk rating: CRITICAL.

Severity	Count
Critical	1
High	2
Low	1

2. Scope & rules of engagement

In scope: the single host 192.168.56.103 on the isolated 192.168.56.0/24 network.
Out of scope: any other host; the internet (the lab has no route out by design).
Window: single session, 2026-07-31.
Methods allowed: full active scanning and exploitation (owned lab).
Knowledge level: black-box — the tester began with only an IP range, no credentials and no documentation (contrast with a prior grey-box engagement on Metasploitable).
Constraint honoured: all activity confined to the authorized, isolated lab; no real or third-party systems touched. The VM can be restored from snapshot.

3. Methodology

Standard penetration-test lifecycle:

Reconnaissance / host discovery — nmap -sn to locate the live host (DHCP-assigned).
Scanning & enumeration — nmap -sV -sC; identified the web application (Drupal 7), not just the web server (Apache), via the http-generator script and robots.txt.
Vulnerability analysis — mapped Drupal 7 to a known CVE with searchsploit; triaged results (discarded DoS and authenticated-only exploits; selected the unauthenticated code-execution path).
Exploitation — gained a low-privilege shell with the Metasploit Drupalgeddon module.
Post-exploitation / privilege escalation — enumerated for local escalation vectors, found and abused a SUID misconfiguration to reach root.
Reporting — this document.

Tools: nmap, searchsploit, msfconsole (Metasploit Framework), GTFOBins (technique reference), standard Linux shell utilities.

4. Findings

Severities use CVSS v3.1 base-metric reasoning (scores marked assessed; the primary CVE predates CVSS v3 scoring). Vectors are the tester’s assessment for this environment.

F-01 — Unauthenticated SQL injection → remote code execution in Drupal 7 (CRITICAL)

CVSS: 9.8 assessed — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CVE-2014-3704 (“Drupalgeddon”)
Affected: Drupal 7 (< 7.32) served by Apache httpd 2.2.22 on tcp/80.
Description: A flaw in Drupal 7’s database abstraction layer lets an unauthenticated attacker inject SQL via a crafted request. This is leveraged to write and execute attacker-controlled PHP, yielding remote code execution as the web-server user (www-data) — no login required.
Evidence: msfconsole → exploit/unix/webapp/drupal_drupageddon (RHOSTS 192.168.56.103, TARGETURI /) opened a Meterpreter session; shell → id returned uid=33(www-data). App version confirmed by http-generator: Drupal 7.
Remediation: Upgrade Drupal to a supported, patched release (7.32+ closed this specific flaw; Drupal 7 as a whole is now end-of-life — migrate to a supported major version). Apply the CMS vendor’s security updates promptly; place the app behind a WAF as defence-in-depth.

F-02 — Local privilege escalation via misconfigured SUID binary (`find`) (HIGH)

CVSS: 7.8 assessed — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: /usr/bin/find carrying the setuid-root bit.
Description: find is installed SUID-root with no legitimate need. Because find can execute arbitrary commands via its -exec action, any local low-privilege user can spawn a shell that retains root’s effective privileges, escalating from www-data to full root.
Evidence: find / -perm -4000 -type f listed find among the SUID binaries; per GTFOBins, find . -exec /bin/bash -p \; -quit returned a shell where id showed euid=0(root). From there /root/thefinalflag.txt was read.
Remediation: Remove the setuid bit (chmod u-s /usr/bin/find). Audit the full SUID/SGID inventory against a known-good baseline; grant elevated capability through sudo with least privilege, not blanket setuid on general-purpose tools.

F-03 — Obsolete, end-of-life software stack (HIGH)

CVSS: 7.5 assessed (aggregate exposure).
Affected: Drupal 7 (EOL), Apache httpd 2.2.22 (EOL), OpenSSH 6.0p1, Debian 7 “wheezy” (EOL).
Description: Every layer of the stack is years past vendor support and missing large numbers of security patches. Beyond F-01, this exposes the host to many additional public exploits and leaves no upstream source of fixes. EOL software cannot be “patched” — only replaced.
Evidence: nmap -sV version banners.
Remediation: Rebuild on a currently-supported OS and application stack. Establish a patch-management process and remove unneeded services (reduce attack surface).

F-04 — Information disclosure: version & path enumeration (LOW)

CVSS: 3.7 assessed — AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: tcp/80 — robots.txt and readable metadata files (MAINTAINERS.txt, LICENSE.txt, install scripts, /scripts/, /modules/).
Description: The site freely serves files that fingerprint the exact platform and reveal installation paths. This hands an attacker the reconnaissance needed to select a matching exploit (as done in this test). It is not itself a breach but materially accelerates one.
Evidence: robots.txt (36 disallowed entries) surfaced by nmap http-robots.txt; metadata files retrievable over HTTP.
Remediation: Remove or restrict access to install/readme/changelog files after deployment; suppress version banners and generator meta tags; serve a minimal robots.txt.

5. Attack narrative (the chain)

Discovery — nmap -sn 192.168.56.0/24 located the target at 192.168.56.103. (An earlier host answered RST-on-all-ports — recognised as reachable but not the target and corrected.)
Enumeration — nmap -sV -sC 192.168.56.103 revealed SSH (22), Apache 2.2.22 (80) and rpcbind (111); the HTTP scripts fingerprinted the application as Drupal 7.
Analysis — searchsploit drupal 7 mapped that to CVE-2014-3704 (Drupalgeddon); the unauthenticated remote-code variant was selected over add-admin / DoS / authenticated options, on the principle “pick the exploit whose output is closest to the next phase” (a shell).
Exploitation — the Metasploit Drupalgeddon module returned a Meterpreter session; shell confirmed a foothold as www-data (unauthenticated).
Privilege escalation — find / -perm -4000 exposed find as SUID-root; abusing its -exec with /bin/bash -p produced a shell with euid=0(root).
Loot — read /root/thefinalflag.txt, confirming full control.

Time from first packet to root: a single session. No credentials were used at any point — the foothold was unauthenticated and root was reached via local misconfiguration.

6. Conclusion & prioritized remediation

DC-1 fell to a textbook two-stage compromise: an unauthenticated application exploit for entry, then a local SUID misconfiguration for escalation. Neither is exotic; both are the direct result of running unmaintained software and skipping host hardening.

Priority order:

Immediate: remove the setuid bit from find (F-02) and apply the Drupal fix / take the app offline until patched (F-01) — together these close the entire demonstrated chain.
Short term: rebuild on a supported OS + CMS; migrate off Drupal 7 and Debian 7 (F-03).
Ongoing: strip information-disclosure files (F-04); baseline the SUID/SGID inventory; establish patch management and periodic vulnerability scanning.

Defence-in-depth note: either fix alone would have blocked this chain — patching Drupal stops the entry, fixing the SUID bit stops the escalation. Layered controls mean one missed patch is not game-over.

Appendix A — Host service inventory

Port	Service	Version
22/tcp	ssh	OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
80/tcp	http	Apache httpd 2.2.22 (Debian) — hosting Drupal 7
111/tcp	rpcbind	2-4 (RPC #100000) + status (random high ports)

Appendix B — MITRE ATT&CK mapping

Write-ups, Pentest

This post is licensed under CC BY 4.0 by the author.