CVE-2018-7600

CVE-2018-7600 root@kitploit: PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 Drupalgeddon 2. Installation: $ git clone https://github.com/dwisiswant0/CVE-2018-7600 $ cd CVE-2018-7600/ $ composer install Usage: $ php exploit.php WARNING! For Educational Purposes Only! References: -...

CVE-2018-7600

CVE-2018-7600 Testing and exploitation tool for Drupalgeddon 2 CVE-2018-7600 Install: sudo pip install -r requirements.txt python Drupalgeddon2.py -t http://drupal.org -c id...

CVE-2018-7600

IMPORTANT: Is provided only for educational or information purposes. Protect rules for ModSecurity by fuzzylogic Protect rules for ModRewrite .htaccess FOR MEDIA: Please do not post a link to this repository in your articles, without specifying how to protect against an attack recommend updating...

web-penetration-drupal

Web Penetration Testing — Drupal CVE-2018-7600 Type: Internship Project | Company: BB CyberSec | Period: Nov 2024 – Jan 2025 📋 Project Overview This project documents a full penetration test conducted on a Drupal web application as part of my cybersecurity internship at BB CyberSec. The assessmen...

exphub

Notice In the end, I still felt that having separate scripts for each vulnerability was very inconvenient, so I integrated all poc and exp scripts into one, enabling one-click scanning + exploitation. Since I've been working on integration recently, Exphub has not been updated for a long time. Th...

drupal-cve-2018-7600-poc

README Drupal Drupalgeddon 2 Unauthenticated Remote Code Execution CVE-2018-7600 Drupal versions prior to 7.58, 8.x versions prior to 8.3.9, 8.4.x versions prior to 8.4.6, and 8.5.x versions prior to 8.5.1 allow remote attackers to execute arbitrary code due to an issue affecting multiple...

drupalgeddon-2

Drupalgeddon-2 Vuln checker for Drupal v7.x + v8.x Usage : root@kitploit: php drupalgeddon.php Target http://example.com :...

Drupalgeddon2-CVE-2018-7600

🔥 Drupalgeddon 2 漏洞利用工具 — bixi.py 📖 简介 bixi.py 是一个针对 CVE‑2018‑7600 Drupalgeddon 2 漏洞的利用工具，该漏洞影响 Drupal 7 。 它通过直观的界面和预定义命令，实现对易受攻击的 Drupal 服务器的远程命令执行 RCE。 ⚠️ 免责声明 / 法律声明 本软件仅用于受控环境下的教育和研究目的。 仅允许在您拥有或获得书面许可的系统上使用 未经授权的使用是非法的 ，可能导致刑事后果 作者不对本工具的滥用行为承担任何责任 请始终遵守当地和国际网络安全法律法规 "能力越大，责任越大" 📋 功能特点 ✅ 自动利用...

Fedora 28 : drupal7 (2018-43c64deada) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/7.59 - https://www.drupal.org/SA-CORE-2018-004 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Fedora 28 : drupal8 (2018-8fd924a53d) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/8.4.8 - https://www.drupal.org/SA-CORE-2018-004 - https://www.drupal.org/project/drupal/releases/8.4.7 - https://www.drupal.org/sa-core-2018-003 RPM update: drupal8-rpmbuild package dependencies fixed Note that Tenable Network Security has extracted...

Cryptojacking Attack Targets Make-A-Wish Foundation Website

Hackers have been stealing CPU-cycles from visitors to the Make-A-Wish Foundation’s international website in order to mine for Monero cryptocurrency. Researchers said they found the CoinIMP mining script embedded in the non-profit’s website, and that it was taking advantage of the Drupalgeddon 2...

Staying Safe in the Era of Browser-based Cryptocurrency Mining

Qualys Malware Research Labs is announcing the release of Qualys BrowserCheck CoinBlocker Chrome extension to detect and block browser-based cryptocurrency mining, aka cryptojacking. Cryptojacking Cryptojacking attacks leverage the victim system’s resources via malicious JavaScript to mine certai...

Fedora 27 : drupal7 (2018-b9ad458866) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/7.59 - https://www.drupal.org/SA-CORE-2018-004 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Fedora 26 : drupal7 (2018-2359c2ae0e) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/7.59 - https://www.drupal.org/SA-CORE-2018-004 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Debian DLA-1365-1 : drupal7 security update (Drupalgeddon 2)

A remote code execution vulnerability has been found within multiple subsystems of Drupal. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. For Debian 7 'Wheezy', these problems have been fixed in version...

Drupal Drupalgeddon 2 Forms API Property Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal Drupalgeddon 2 Forms API Property Injection', 'Description' = %q This module exploits a Drupal property injection in the Forms API. Drupal...

Drupal Drupalgeddon 2 Forms API Property Injection Exploit

This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source:...

Exploit for Improper Input Validation in Drupal

Drupalgeddon 2 MSF exploit module for Drupalgeddon 2 CVE-201...

Debian DSA-4156-1 : drupal7 - security update (Drupalgeddon 2)

A remote code execution vulnerability has been found in Drupal, a fully-featured content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2018-002 C Tenable Network Security, Inc. The descriptive text and package checks in...

Drupal Drupalgeddon 2 Forms API Property Injection

This module exploits a Drupal property injection in the Forms API. Drupal 6.x, use exploit/unix/webapp/drupal/drupalgeddon2 msf undefineddrupalgeddon2 show actions ...actions... msf undefineddrupalgeddon2 set ACTION msf undefineddrupalgeddon2 show options ...show and set options... msf...