So let's say that in a reconnaissance phase, while extracting directory structures, we detect a drupa
folder.
So we need to dig into that folder also.
And we can do many things at this point with Duvel.
But I want to focus on a known of vulnerability.
It's called Droop again.
So when it was first announced, I saw many Web apps vulnerable to it, so here my point is you need
to understand that there are known vulnerabilities out there.
You need to look for known vulnerabilities by using an automated scanner or with your own script.
That also.
You should also go after any information that you detect.
But in any event, let's exploit this vulnerability.
So first we need to discover it.
Now, because it's Drupal insulation, we need the version information in order to detect it.
And to detect the version there just will have to be several ways, but the best is looking for predefined
files on the Drupal installation.
So you're going to see a bunch of them in a Drupal folder like that.
So type changelog t t.
And it's an innocent enough file, don't you think?
But here we get the version information.
The first release of Drupa get an attack affected versions under 73 to.
So, yeah, this version of Drupal on PAYBOX is vulnerable.
So the next thing is finding the exploitation code.
OK, so now I would like to introduce you to exploit that divide outcome.
The XPoint database is a wonderful Web application, it holds lots of exploitation codes and payloads
for vulnerabilities.
And again, it is run by offensive security.
And it gives you a search interface.
So you can check verified for verified exploit.
And I already wrote Drupal in the search box and the exploits related to Drupal are listed right before
you.
So there are three pages.
You're going to examine them if you wish.
And generally, you can see more than one exploit for a particular vulnerability.
But you said choose whichever one works best for yourself.
So it's the same for Drupa Gaden also, and I'm going to use this one.
So you can also hear the content of the exploit code.
Just download it and save it.
And here it is in my download folder.
Now, before downloading and running exploit codes, though, you really should examine them.
I mean, maybe they're militias for your system, right?
And also, they may need to be modified.
So let's view it.
And it is encoded with BHP, so I'm going to change it here to the B Web address on B box.
And for the purpose of this course, I'm going to change this year to seven.
You don't need to then save the file.
And before execution, I will show you Drupal users, so I've logged into my IP, my admin.
And browse the user's table under the drupa in database.
And here are the Drupal users.
Now, what will the downloaded exploit do?
It will change the name and password of a seventh user to admen.
OK, go back to terminal.
And run it like that.
And it's already happened, so we updated the user information.
So now go back to Chrome, refresh, browse the user's table again.
And here is the updated user information.
What do you think?
So let's open Firefox.
Log in with the admin user.
Congratulations, you exploited the vulnerability.
So now you're in the Drupal interface.
And we can go on more to understand how this attack happens, so click the admin button and edit.
So this is the user information page.
OK, so open the web developer tool.
And pick the password element here.
Then look at the HTML code, the name attribute has an array style value.
Then pick the confirmed password element, it also has an array style name value.
So let's fill in the form.
And enable Foxe proxy.
Then save and go back to berp.
And the request will look like that.
And here are the password fields.
And they have a race style values.
So let the request go, OK, go to Firefox and log out.
Disable Foxe proxy as well.
And one more time, open up the web developer.
Pick this element.
Right, click on it.
Edit this HTML.
Now copy this line and pasted below.
But to zero here.
And then add this payload instead of the name attribute.
And this payload will update the first user and his password to admen.
OK, then, so now I'm going to delete the admin user.
It doesn't allow to admin users.
So we can fill in the fields with some junk data.
And Abel Foxe proxy.
Then log in.
And this login request included our payload.
And there's nothing more to change, so let it go.
Now open chrome and refresh the page.
And now the content of the users table is here.
So look at the first line.
The user with ID one is changed to admin.
So now we can log in with this user as well.
And the last thing we can do is for now is view the vulnerable code.
But this function does not check the inputs, but you know what, I know you know how to do it, so
I'll leave it for you.
Go for it.