Drupal

Discovery

Check meta

curl https://www.drupal.org/ | grep 'content="Drupal'

Node: Drupal content entities of the node type represent items such as articles and pages. Canonical routes commonly use /node/<nodeid>, although aliases can hide that route.^[2]

curl drupal-site.com/node/1

Enumeration

Version

Check /CHANGELOG.txt

curl -s http://drupal-site.local/CHANGELOG.txt | grep -m2 ""

Drupal 7.57, 2018-02-21

[!TIP] Newer installs of Drupal by default block access to the CHANGELOG.txt and README.txt files.

Username enumeration

Drupal installs define the following broad roles by default; permissions and any additional roles are site-configurable:^[3]

Administrator: This user has complete control over the Drupal website.
Authenticated User: These users can log in to the website and perform operations such as adding and editing articles based on their permissions.
Anonymous: All website visitors are designated as anonymous. By default, these users are only allowed to read posts.

To enumerate users you can:

Profile probing: Request /user/1, /user/2, /user/3 and compare status, body, redirects, and timing. This only enumerates users when the site exposes distinguishable responses.
Registry: Access/user/register and try to create a username and if the name is already taken it will be indicated in an error from the server.
Reset password: Try to reset the password of a user and if the user doesn’t exist it will be indicated clearly in an error message.

Hidden pages

Just find new pages by looking into /node/FUZZ where FUZZ is a number (from 1 to 1000 for example).

Installed modules info

Exposed configuration-synchronization files may reveal enabled modules and service settings.^[5]

# Technique shared by Intigriti; see reference 5
#Get info on installed modules
curl https://example.com/config/sync/core.extension.yml
curl https://example.com/core/core.services.yml

# Download content from files exposed in the previous step
curl https://example.com/config/sync/swiftmailer.transport.yml

Automatic Tools

droopescan scan drupal -u http://drupal-site.local

droopescan fingerprints CMS versions, plug-ins, and themes; validate its findings manually because content filtering and customized paths can cause false results.^[4]

RCE

If you have access to the Drupal web console check these options to get RCE:

Drupal Rce

From XSS to RCE

Drupalwned is a Drupal exploitation script whose documented chains can elevate XSS into RCE or other critical impact.^[1][6] Its documented targets include Drupal 7.x through 10.x, and it supports:
- Privilege Escalation: Creates an administrative user in Drupal.
- (RCE) Upload Template: Upload custom templates backdoored to Drupal.

Post Exploitation

Read settings.php

find / -name settings.php -exec grep "drupal_hash_salt\|'database'\|'username'\|'password'\|'host'\|'port'\|'driver'\|'prefix'" {} \; 2>/dev/null

Dump users from DB

mysql -u drupaluser --password='2r9u8hu23t532erew' -e 'use drupal; select * from users'