immunit/drupwn

Drupal enumeration & exploitation tool

Drupwn [v1.0.4]

Description

Drupwn claims to provide an efficient way to gather drupal information.

Enumeration

Exploitation

Further explaination on our blog post article

Supported tested version

• Drupal 7
• Drupal 8

Execution mode

Drupwn can be run, using two seperate modes which are enum and exploit. The enum mode allows performing enumerations whereas the exploit mode allows checking and exploiting CVEs.

Functionalities

Enum mode

• User enumeration
• Node enumeration
• Default files enumeration
• Module enumeration
• Theme enumeration
• Cookies support
• User-Agent support
• Basic authentication support
• Request delay
• Enumeration range
• Logging
• Socks and HTTP proxy support

Exploit mode

• Vulnerability checker
• CVE exploiter

Installation

pip3 install -r requirements.txt
python3 drupwn --help

or

python3 setup.py install
drupwn --help

Usage

$ drupwn -h

        ____
       / __ \_______  ______ _      ______
      / / / / ___/ / / / __ \ | /| / / __ \
     / /_/ / /  / /_/ / /_/ / |/ |/ / / / /
    /_____/_/   \__,_/ .___/|__/|__/_/ /_/
                     /_/

usage: drupwn [-h] [--mode MODE] [--target TARGET] [--users] [--nodes] [--modules] [--dfiles] [--themes]
              [--version VERSION] [--cookies COOKIES] [--thread THREAD]
              [--range RANGE] [--ua UA] [--bauth BAUTH]
              [--delay DELAY] [--log] [--update] 
              [--proxy PROXY | --proxies PROXIES]

Drupwn aims to automate drupal information gathering.

optional arguments:
  -h, --help         show this help message and exit
  --mode MODE        enum|exploit
  --target TARGET    hostname to scan
  --users            user enumaration
  --nodes            node enumeration
  --modules          module enumeration
  --dfiles           default files enumeration
  --themes           theme enumeration
  --version VERSION  Drupal version
  --cookies COOKIES  cookies
  --thread THREAD    threads number
  --range RANGE      enumeration range
  --ua UA            User Agent
  --bauth BAUTH      Basic authentication
  --delay DELAY      request delay
  --log              file logging
  --update           update plugins and themes
  --proxy PROXY      [http|https|socks]://host:port
  --proxies PROXIES  Proxies file

Docker alternative

Official image

You can pull the official Drupwn image from the dockerhub registry using the following command:

docker pull immunit/drupwn

Build

To build the container, just use this command:

docker build -t drupwn .

Docker will download the Alpine image and then execute the installation steps.

Be patient, the process can be quite long the first time.

Run

Once the build process is over, get and enjoy your new Drupal scanner

docker run --rm -it drupwn --help

Logging

The output generated is stored in the /tmp/ folder. When using docker, run your container using the following option

-v YOUR_PATH_FOLDER:/tmp/

Enhancement

To add a new module, follow the template used in the User.py file. Then, add a reference in the Parser as well as in the Dispatcher in order to ensure its support by the reflective factory.

Disclaimer of Warranty

Drupwn is provided under this License on an "as is" basis, without warranty of any kind, either expressed, implied, or statutory, including, without limitation, warranties that the Drupwn is free of defects, merchantable, fit for a particular purpose or non-infringing.

Disclaimer

Running Drupwn against websites without prior mutual consent may be illegal in your country. The ImmunIT Team accept no liability and are not responsible for any misuse or damage caused by Drupwn.

drupwn's Issues

Publish docker Container in Docker Hub

The docker Container could be prebuilt and published in Docker Hub.

Also using a smaller base image would be nice, maybe alpine fits?

asciinema: This recording has been archived

All unclaimed recordings (the ones not linked to any user account) are automatically archived 7 days after upload.

https://asciinema.org/a/J6dQmUJVskyHV07iARITfoLan

Save the log file with your own desired name and location

Hey!
Thank you for this awesome tool.
I'm facing the issue in saving the logs. As I'm running this tool on multiple sites I want to store the results(logs) with the domain name in my desired destination.
For now, there is no option like this..!
Can you please give me some hint how could I achieve this?

Confusing parameters structure

Hello,

The tool seems very solid but I am having issues trying to understand the parameters structure. Can you provide a few sample commands?

Every time I try to run a command it replies:

sudo python3 drupwn --dfiles enum https://www6.pagegoeshere.com/

[-] Version not specified, trying to identify it

[-] The automatic detection failed. Please specify a version

[Feature] Module path

New version of Drupal host modules on the /module directory. This path must be added to the supported list path of the module plugin.

FIle: plugins/Modules.phy line 22

ImportError: No module named prompt_toolkit

Python 3.7.7

Traceback (most recent call last):
File "./drupwn", line 8, in
from engine.Exploiter import Exploiter
File "/opt/drupwn/engine/Exploiter.py", line 6, in
from prompt_toolkit import prompt
ImportError: No module named prompt_toolkit

contribution guidelines

based on #22 and #23 you should create a CONTRIBUTING.md or similar file to explain contribution guidelines like making PR in develop branch, etc.

I wrote an overkill one for one of my projects: https://inventory.rawsec.ml/docs/docs/en/add.html

AttributeError: 'NoneType' object has no attribute 'group'

Traceback (most recent call last):
File "drupwn", line 48, in
Fingerprinter(request, logger).fingerprint(config)
File "/home/dwpt/drupwn/engine/Fingerprinter.py", line 25, in fingerprint
config["version"] = float(version.group(0))
AttributeError: 'NoneType' object has no attribute 'group'

exploits/CVE-2018-7602/Exploit.py "Did you provided" => "Did you provide"

Minor mispelling : "User must be authenticated. Did you provided a session cookie ?"
==>
"User must be authenticated. Did you provide a session cookie ?"

drupwn: error: unrecognized arguments: enum

After Installing the Drupum I tried a sample website but showing like this
drupwn: error: unrecognized arguments: enum

README mentions WPScan

Warranty refers to WPScan instead of Drupwn. Copy/paste error?

Bug in module detection

Hi,

While logging the requests to my webserver I saw that theres something wrong with the "modules" detection. A slash is missing on the url.

Example request being made:

GET /sites/default/modulesrestws_views/restws_views.module

There is a / missing after "modules".

You need to edit this line:
https://github.com/immunIT/drupwn/blob/master/plugins/Modules.py#L22

And probably add a slash after the path.

Thanks for your work, this is pretty nice!

🐞 False positive detection due to incorrect error handling

Problem

When HTTP connections fail droopescan reports the test as a positive result, e.g. it found a module.

5 GET requests to detect modules, such as the following, timed out without a response. These are displayed in the output as found.

GET /sites/default/modules/content_glider/content_glider.module HTTP/1.1

Recommendation

If the connection fails it should retry for a set number of times.

Environment

I'm using Kali with the latest version of droopescan that is current with master branch.

Usage

I used the following command. This connected to the Burp proxy.

python3 ./drupwn --target https://xxx --bauth asdfsadfsadfsadf== --version 8 --mode enum --proxy 127.0.0.1:8080 --log

# Logs

The log is as follows. All Modules found were false positives.

============ Themes ============

[+] seven
[+] stark
[+] bartik
[+] classy

============ Custom Themes ============


============ Default files ============

[+] /web.config (403)
[+] /robots.txt (200)
[+] /update.php (403)
[+] /install.php (200)

============ Modules ============

[+] HWCTravel
[+] popups_reference
[+] imageslider
[+] content_glider
[+] active_tags


============ Custom Modules ============


============ Nodes ============

https://xxx/node/491
https://xxx/node/675

============ Users ============

Inventory notification

drupwn has been inventoried on Rawsec's CyberSecurity Inventory.

https://inventory.rawsec.ml/tools.html#drupwn

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool and improve its referencing.

Badges

The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make our open project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care. Else you can close this issue.

Local privilege escalation through temporary file

In engine/Logger.py line 13 we read:

if status:
    self.fd = open("/tmp/drupwn.txt", "w")

This opens the possibility for a privilege escalation as any user might create the file /tmp/drupwn.txt in advance and redirect its output through a symbolic link. Rewritting ~/.ssh/authorized_keys for example gives shell access to that user's account.

Granted most pentesters don't run security tools on shared machines, but there is no reason to leave that door open either. A securely opened and randomly named file should be used instead:

import tempfile

if status:
    self.fd = tempfile.NamedTemporaryFile(prefix="drupwn-", suffix=".txt", mode="w")

(mktemp is not secure in python, mkstemp isn't nice to work with,
TemporaryFile doesn't create an actual file on linux so it's no good for
logging, hence NamedTemporaryFile.)

Bonus: that also makes drupwn less platform dependent.

ImportError: cannot import name 'WordCompleter'

Hello,

I'm running into an issue where drupwn cannot import name 'WordCompleter'. Per the instructions in the ReadMe, I've followed these steps...

pip3 install -r requirements.txt
python3 drupwn --help

Still got the error. Then tried...

python3 setup.py install
drupwn --help

Still got the error.

Here's the version of Kali that I'm running:
Linux kali 4.16.0-kali2-amd64 #1 SMP Debian 4.16.12-1kali1 (2018-05-28) x86_64 GNU/Linux

Here's the full error I'm getting:

python3 drupwn --help
Traceback (most recent call last):
File "drupwn", line 8, in
from engine.Exploiter import Exploiter
File "/root/Tools/drupwn/engine/Exploiter.py", line 7, in
from prompt_toolkit.contrib.completers import WordCompleter
ImportError: cannot import name 'WordCompleter'

drupwn --help
Traceback (most recent call last):
File "/usr/local/bin/drupwn", line 4, in
import('pkg_resources').run_script('drupwn==0.9.2', 'drupwn')
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 654, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 1441, in run_script
exec(script_code, namespace, namespace)
File "/usr/local/lib/python3.6/dist-packages/drupwn-0.9.2-py3.6.egg/EGG-INFO/scripts/drupwn", line 8, in
File "/usr/local/lib/python3.6/dist-packages/drupwn-0.9.2-py3.6.egg/engine/Exploiter.py", line 7, in
ImportError: cannot import name 'WordCompleter'

Thanks for the help.

timeout not handled

$ drupwn enum http://xxx                                                                                                                
                                                                                                                                                                                                                   
        ____                                                                                                                                                                                                       
       / __ \_______  ______ _      ______                                                                                                                                                                         
      / / / / ___/ / / / __ \ | /| / / __ \                                                                                                                                                                        
     / /_/ / /  / /_/ / /_/ / |/ |/ / / / /                                                                                                                                                                        
    /_____/_/   \__,_/ .___/|__/|__/_/ /_/                                                                                                                                                                         
                     /_/                                                                                                                                                                                           
                                                                                                                                                                                                                   
[-] Version not specified, trying to identify it                                                                                                                                                                   
Traceback (most recent call last):                                                                                                                                                                                 
  File "/usr/lib/python3.7/site-packages/urllib3/connection.py", line 159, in _new_conn                                                                                                                            
    (self._dns_host, self.port), self.timeout, **extra_kw)                                                                                                                                                         
  File "/usr/lib/python3.7/site-packages/urllib3/util/connection.py", line 80, in create_connection                                                                                                                
    raise err                                                                                                                                                                                                      
  File "/usr/lib/python3.7/site-packages/urllib3/util/connection.py", line 70, in create_connection                                                                                                                
    sock.connect(sa)                                                                                                                                                                                               
TimeoutError: [Errno 110] Connection timed out                                                                                                                                                                     
                                                                                                                                                                                                                   
During handling of the above exception, another exception occurred:                                                                                                                                                
                                                                                                                                                                                                                   
Traceback (most recent call last):                                                                                                                                                                                 
  File "/usr/lib/python3.7/site-packages/urllib3/connectionpool.py", line 600, in urlopen                                                                                                                          
    chunked=chunked)                                                                                                                                                                                               
  File "/usr/lib/python3.7/site-packages/urllib3/connectionpool.py", line 354, in _make_request                                                                                                                    
    conn.request(method, url, **httplib_request_kw)                                                                                                                                                                
  File "/usr/lib/python3.7/http/client.py", line 1229, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/usr/lib/python3.7/http/client.py", line 1275, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.7/http/client.py", line 1224, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.7/http/client.py", line 1016, in _send_output
    self.send(msg)
  File "/usr/lib/python3.7/http/client.py", line 956, in send
    self.connect()
  File "/usr/lib/python3.7/site-packages/urllib3/connection.py", line 181, in connect
    conn = self._new_conn()
  File "/usr/lib/python3.7/site-packages/urllib3/connection.py", line 168, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
urllib3.exceptions.NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f8e76308898>: Failed to establish a new connection: [Errno 110] Connection timed out                                       

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "/usr/lib/python3.7/site-packages/urllib3/connectionpool.py", line 638, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/lib/python3.7/site-packages/urllib3/util/retry.py", line 398, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPConnectionPool(host='xxx', port=80): Max retries exceeded with url: /CHANGELOG.txt (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f8e76308898>: Failed to establish a new connection: [Errno 110] Connection timed out'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "drupwn", line 37, in <module>
    Fingerprinter(request, logger).fingerprint(config)
  File "/usr/share/drupwn/engine/Fingerprinter.py", line 19, in fingerprint
    config["version"] = self._getDefaultFilesVersion()
  File "/usr/share/drupwn/engine/Fingerprinter.py", line 58, in _getDefaultFilesVersion
    r = self.request.get(dfile)
  File "/usr/share/drupwn/engine/Request.py", line 52, in get
    return self.session.get(self.url + path, headers=self.headers, cookies=self.cookies, proxies=proxies, verify=False)                                                                                           
  File "/usr/lib/python3.7/site-packages/requests/sessions.py", line 546, in get
    return self.request('GET', url, **kwargs)
  File "/usr/lib/python3.7/site-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.7/site-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.7/site-packages/requests/adapters.py", line 516, in send
    raise ConnectionError(e, request=request)
requests.exceptions.ConnectionError: HTTPConnectionPool(host='xxx', port=80): Max retries exceeded with url: /CHANGELOG.txt (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f8e76308898>: Failed to establish a new connection: [Errno 110] Connection timed out'))

$ python --version 
Python 3.7.2

How can I get the usernames from the userid?

Am wondering if that is possible thanks.