Drupal

Discovery

• Check meta

curl https://www.drupal.org/ | grep 'content="Drupal'

• Node: Drupal content entities of the node type represent items such as articles and pages. Canonical routes commonly use /node/<nodeid>, although aliases can hide that route.^[2]

curl drupal-site.com/node/1

Enumeration

Version

• Check /CHANGELOG.txt

curl -s http://drupal-site.local/CHANGELOG.txt | grep -m2 ""

Drupal 7.57, 2018-02-21

[!TIP] Newer installs of Drupal by default block access to the CHANGELOG.txt and README.txt files.

Username enumeration

Drupal installs define the following broad roles by default; permissions and any additional roles are site-configurable:^[3]

1. Administrator: This user has complete control over the Drupal website.
2. Authenticated User: These users can log in to the website and perform operations such as adding and editing articles based on their permissions.
3. Anonymous: All website visitors are designated as anonymous. By default, these users are only allowed to read posts.

To enumerate users you can:

• Profile probing: Request /user/1, /user/2, /user/3 and compare status, body, redirects, and timing. This only enumerates users when the site exposes distinguishable responses.
• Registry: Access/user/register and try to create a username and if the name is already taken it will be indicated in an error from the server.
• Reset password: Try to reset the password of a user and if the user doesn’t exist it will be indicated clearly in an error message.

Hidden pages

Just find new pages by looking into /node/FUZZ where FUZZ is a number (from 1 to 1000 for example).

Installed modules info

Exposed configuration-synchronization files may reveal enabled modules and service settings.^[5]

# Technique shared by Intigriti; see reference 5
#Get info on installed modules
curl https://example.com/config/sync/core.extension.yml
curl https://example.com/core/core.services.yml

# Download content from files exposed in the previous step
curl https://example.com/config/sync/swiftmailer.transport.yml

Automatic Tools

droopescan scan drupal -u http://drupal-site.local

droopescan fingerprints CMS versions, plug-ins, and themes; validate its findings manually because content filtering and customized paths can cause false results.^[4]

RCE

If you have access to the Drupal web console check these options to get RCE:

Drupal Rce

From XSS to RCE

• Drupalwned is a Drupal exploitation script whose documented chains can elevate XSS into RCE or other critical impact.^[1][6] Its documented targets include Drupal 7.x through 10.x, and it supports:
  • Privilege Escalation: Creates an administrative user in Drupal.
  • (RCE) Upload Template: Upload custom templates backdoored to Drupal.

Post Exploitation

Read settings.php

find / -name settings.php -exec grep "drupal_hash_salt\|'database'\|'username'\|'password'\|'host'\|'port'\|'driver'\|'prefix'" {} \; 2>/dev/null

Dump users from DB

mysql -u drupaluser --password='2r9u8hu23t532erew' -e 'use drupal; select * from users'

References

• [1] Elevating Low Vulnerabilities to Critical in CMSs and E-Commerce Platforms
• [2] Drupal documentation — Concept: Content entities and fields
• [3] Drupal documentation — Concept: Users, roles, and permissions
• [4] SamJoan/droopescan
• [5] Intigriti — exposed Drupal configuration synchronization files
• [6] nowak0x01/Drupalwned