Hands-On Web Penetration Testing with Metasploit

Exploiting Drupalgeddon2 using Metasploit

A Metasploit module is also available to exploit the Drupalgeddon2 vulnerability, and we can use it by executing this command in msfconsole:

use exploit/unix/webapp/drupal_drupalgeddon2

Now, perform the following steps to exploit the vulnerability:

1. To view the options, we run show options, as shown here:

2. Next, we set the options of rhosts and rport, as shown in the following screenshot:

3. When the exploit is run, it first performs fingerprinting by looking for the Drupal version in the response header ...