---
description: Open-source Content Management System (CMS)
---

# Drupal

Drupal is written in PHP and supports using MySQL or PostgreSQL for the backend. Additionally, SQLite can be used if there's no DBMS installed.

## Tools

<table><thead><tr><th width="149">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/droope/droopescan">droopescan</a></td><td>A plugin-based scanner that aids security researchers in identifying issues with several CMS.<br><code>droopescan scan drupal --url &#x3C;URL></code></td></tr></tbody></table>

## Default Users

<table><thead><tr><th width="231">Role</th><th>Description</th></tr></thead><tbody><tr><td>Administrator</td><td>This user has complete control over the Drupal website.</td></tr><tr><td>Authenticated User</td><td>These users can log in to the website and perform operations such as adding and editing articles based on their permissions.</td></tr><tr><td>Anonymous</td><td>All website visitors are designated as anonymous. By default, these users are only allowed to read posts.</td></tr></tbody></table>

## Manual Enumeration

### Version

<table data-header-hidden><thead><tr><th width="183"></th><th></th></tr></thead><tbody><tr><td>Source code</td><td>Meta tag of name generator:<br><code>&#x3C;meta name="Generator" content="Drupal 8 (https://www.drupal.org)" /></code></td></tr><tr><td><code>CHANGELOG.txt</code></td><td>In the Drupal root directory</td></tr><tr><td><code>README.txt</code></td><td>In the Drupal root directory</td></tr><tr><td><a href="https://www.drupal.org/docs/8/core/modules/node/about-nodes">nodes</a></td><td><code>/node/&#x3C;NODE_ID></code></td></tr></tbody></table>

## Attacks

### Built-in

#### Before version 8

In older versions of Drupal (before version 8), it was possible to log in as an admin and enable the `PHP filter` module, which "Allows embedded PHP code/snippets to be evaluated."\
In modules menu, we could tick the check box next to the module and scroll down to `Save configuration`. Next, we could go to `Content` --> `Add content` and create a `Basic page`. We can now create a page with a malicious PHP snippet. We also want to make sure to set `Text format` drop-down to `PHP code`. After clicking save, we will be redirected to the new page, ex. `http://<DOMAIN>/node/<ID>`.

#### From version 8&#x20;

From version 8 onwards, the [PHP Filter](https://www.drupal.org/project/php/releases/8.x-1.1) module is not installed by default. To leverage this functionality, we would have to install the module ourselves.\
We'd start by downloading the most recent version of the module from the Drupal website ([link](https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz)). Once downloaded go to `Administration` > `Reports` > `Available updates` (_Location may differ based on the Drupal version and may be under the Extend menu_). From here, click on `Browse,` select the file from the directory we downloaded it to, and then click `Install`. Once the module is installed, we can click on `Content` and create a new basic page, similar to how we did in the Drupal 7.

### Backdoor Module

Drupal allows users with appropriate permissions to upload a new module. A backdoored module can be created by adding a shell to an existing module. Modules can be found on the drupal.org website.&#x20;

* Let's pick a module such as [CAPTCHA](https://www.drupal.org/project/captcha). Scroll down and copy the link for the tar.gz [archive](https://ftp.drupal.org/files/projects/captcha-8.x-1.2.tar.gz). Download the archive and extract its contents.&#x20;
* Create a PHP web shell.&#x20;
*   Next, we need to create a `.htaccess` file to give ourselves access to the folder. This is necessary as Drupal denies direct access to the /modules folder.

    ```html
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    </IfModule>
    ```

    The configuration above will apply rules for the `/` folder when we request a file in `/modules`.&#x20;
*   Copy both of these files to the captcha folder and create an archive.

    ```bash
    mv shell.php .htaccess captcha
    tar cvf captcha.tar.gz captcha/
    ```
* With administrative access, click on `Manage` and then `Extend` on the sidebar. Next, click on the `+ Install new module` button, and we will be taken to the install page, such as `http://<DOMAIN>/admin/modules/install`. Browse to the backdoored Captcha archive and click `Install`.
* Once the installation succeeds, browse to `/modules/captcha/shell.php` to execute commands.

## CVE

<table><thead><tr><th width="223"></th><th></th></tr></thead><tbody><tr><td><a href="https://nvd.nist.gov/vuln/detail/CVE-2014-3704">CVE-2014-3704</a></td><td><a href="https://www.exploit-db.com/exploits/34992"><code>Drupalgeddon</code></a><br>Affects versions 7.0 up to 7.31 and was fixed in version 7.32.<br>This was a pre-authenticated SQL injection flaw that could be used to upload a malicious form or create a new admin user.</td></tr><tr><td><a href="https://nvd.nist.gov/vuln/detail/CVE-2018-7600">CVE-2018-7600</a></td><td><code>Drupalgeddon2</code><br>Affects versions of Drupal prior to 7.58 and 8.5.1.<br>Is a remote code execution vulnerability. The vulnerability occurs due to insufficient input sanitization during user registration, allowing system-level commands to be maliciously injected.</td></tr><tr><td><a href="https://nvd.nist.gov/vuln/detail/CVE-2018-7602">CVE-2018-7602</a></td><td><code>Drupalgeddon3</code><br>Affects multiple versions of Drupal 7.x and 8.x.<br>Is a remote code execution vulnerability. This flaw exploits improper validation in the Form API.</td></tr></tbody></table>
