‫So let's say that in a reconnaissance phase, while extracting directory structures, we detect a drupa
‫folder.
‫So we need to dig into that folder also.
‫And we can do many things at this point with Duvel.
‫But I want to focus on a known of vulnerability.
‫It's called Droop again.
‫So when it was first announced, I saw many Web apps vulnerable to it, so here my point is you need
‫to understand that there are known vulnerabilities out there.
‫You need to look for known vulnerabilities by using an automated scanner or with your own script.
‫That also.
‫You should also go after any information that you detect.
‫But in any event, let's exploit this vulnerability.
‫So first we need to discover it.
‫Now, because it's Drupal insulation, we need the version information in order to detect it.
‫And to detect the version there just will have to be several ways, but the best is looking for predefined
‫files on the Drupal installation.
‫So you're going to see a bunch of them in a Drupal folder like that.
‫So type changelog t t.
‫And it's an innocent enough file, don't you think?
‫But here we get the version information.
‫The first release of Drupa get an attack affected versions under 73 to.
‫So, yeah, this version of Drupal on PAYBOX is vulnerable.
‫So the next thing is finding the exploitation code.
‫OK, so now I would like to introduce you to exploit that divide outcome.
‫The XPoint database is a wonderful Web application, it holds lots of exploitation codes and payloads
‫for vulnerabilities.
‫And again, it is run by offensive security.
‫And it gives you a search interface.
‫So you can check verified for verified exploit.
‫And I already wrote Drupal in the search box and the exploits related to Drupal are listed right before
‫you.
‫So there are three pages.
‫You're going to examine them if you wish.
‫And generally, you can see more than one exploit for a particular vulnerability.
‫But you said choose whichever one works best for yourself.
‫So it's the same for Drupa Gaden also, and I'm going to use this one.
‫So you can also hear the content of the exploit code.
‫Just download it and save it.
‫And here it is in my download folder.
‫Now, before downloading and running exploit codes, though, you really should examine them.
‫I mean, maybe they're militias for your system, right?
‫And also, they may need to be modified.
‫So let's view it.
‫And it is encoded with BHP, so I'm going to change it here to the B Web address on B box.
‫And for the purpose of this course, I'm going to change this year to seven.
‫You don't need to then save the file.
‫And before execution, I will show you Drupal users, so I've logged into my IP, my admin.
‫And browse the user's table under the drupa in database.
‫And here are the Drupal users.
‫Now, what will the downloaded exploit do?
‫It will change the name and password of a seventh user to admen.
‫OK, go back to terminal.
‫And run it like that.
‫And it's already happened, so we updated the user information.
‫So now go back to Chrome, refresh, browse the user's table again.
‫And here is the updated user information.
‫What do you think?
‫So let's open Firefox.
‫Log in with the admin user.
‫Congratulations, you exploited the vulnerability.
‫So now you're in the Drupal interface.
‫And we can go on more to understand how this attack happens, so click the admin button and edit.
‫So this is the user information page.
‫OK, so open the web developer tool.
‫And pick the password element here.
‫Then look at the HTML code, the name attribute has an array style value.
‫Then pick the confirmed password element, it also has an array style name value.
‫So let's fill in the form.
‫And enable Foxe proxy.
‫Then save and go back to berp.
‫And the request will look like that.
‫And here are the password fields.
‫And they have a race style values.
‫So let the request go, OK, go to Firefox and log out.
‫Disable Foxe proxy as well.
‫And one more time, open up the web developer.
‫Pick this element.
‫Right, click on it.
‫Edit this HTML.
‫Now copy this line and pasted below.
‫But to zero here.
‫And then add this payload instead of the name attribute.
‫And this payload will update the first user and his password to admen.
‫OK, then, so now I'm going to delete the admin user.
‫It doesn't allow to admin users.
‫So we can fill in the fields with some junk data.
‫And Abel Foxe proxy.
‫Then log in.
‫And this login request included our payload.
‫And there's nothing more to change, so let it go.
‫Now open chrome and refresh the page.
‫And now the content of the users table is here.
‫So look at the first line.
‫The user with ID one is changed to admin.
‫So now we can log in with this user as well.
‫And the last thing we can do is for now is view the vulnerable code.
‫But this function does not check the inputs, but you know what, I know you know how to do it, so
‫I'll leave it for you.
‫Go for it.