drupalgeddon-2

Drupalgeddon-2 Drupal v7.x + v8.x 漏洞检测工具 使用方法 : root@kitploit: php drupalgeddon.php Target http://example.com :...

CVE-2018-7600

重要提示： 仅用于教育或信息目的。 ModSecurity的保护规则 by fuzzylogic ModRewrite .htaccess的保护规则 致媒体： 请不要在您的文章中将此仓库链接发布，而不说明如何防御攻击（建议更新Drupal、设置WAF规则等）。 基于CheckPoint文章的PoC。 https://research.checkpoint.com/uncovering-drupalgeddon-2/ 作者：Eyal Shalev、Rotem Reiss 和 Eran Vaknin PoC在Drupal 7.x上无效。Drupal 7.x和8.x请参见此处。...

CVE-2018-7600-Drupal-POC-EXP

root@kitploit: +----------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + Drupal Drupalgeddon 2 远程代码执行 CVE-2018-7600 + +----------------------------------------------------------------------+ + USE: python3 + + EXP: python3...

CVE-2018-7600

CVE-2018-7600 Herramienta de prueba y explotación para Drupalgeddon 2 CVE-2018-7600 Instalación: sudo pip install -r requirements.txt python Drupalgeddon2.py -t http://drupal.org -c id...

CVE-2018-7600

CVE-2018-7600 root@kitploit: CVE-2018-7600 Drupal SA-CORE-2018-002 Drupalgeddon 2 的概念验证利用。 安装: $ git clone https://github.com/dwisiswant0/CVE-2018-7600 $ cd CVE-2018-7600/ $ composer install 用法: $ php exploit.php 警告! 仅供教育用途！ 参考: - https://research.checkpoint.com/uncovering-drupalgeddon-2/ -...

web-penetration-drupal

Pruebas de Penetración Web — Drupal CVE-2018-7600 Tipo: Proyecto de Prácticas | Empresa: BB CyberSec | Período: Nov 2024 – Ene 2025 📋 Resumen del Proyecto Este proyecto documenta una prueba de penetración completa realizada sobre una aplicación web Drupal como parte de mis prácticas de...

drupal-cve-2018-7600-poc

Drupal Drupalgeddon 2 未授权远程代码执行漏洞（CVE-2018-7600） Drupal是一个使用PHP编写的免费开源的Web内容管理框架。 在Drupal 7.58之前的版本、8.3.9之前的8.x版本、8.4.6之前的8.4.x版本和8.5.1之前的8.5.x版本中存在远程代码执行漏洞。该漏洞影响了多个具有默认或常见模块配置的子系统，包括Form API。 参考链接： https://www.drupal.org/sa-core-2018-002 https://research.checkpoint.com/uncovering-drupalgeddon-2/...

Drupalgeddon2-CVE-2018-7600

🔥 Drupalgeddon 2 Exploit — bixi.py 📖 الوصف bixi.py هو أداة استغلال للثغرة CVE‑2018‑7600 Drupalgeddon 2 التي تؤثر على Drupal 7. يتيح تنفيذ الأوامر عن بُعد RCE على خوادم Drupal الضعيفة عبر واجهة بديهية وأوامر محددة مسبقًا. ⚠️ إخلاء المسؤولية / تنبيه قانوني هذا البرنامج مخصص فقط للأغراض التعليمية...

Fedora 28 : drupal7 (2018-43c64deada) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/7.59 - https://www.drupal.org/SA-CORE-2018-004 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Fedora 28 : drupal8 (2018-8fd924a53d) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/8.4.8 - https://www.drupal.org/SA-CORE-2018-004 - https://www.drupal.org/project/drupal/releases/8.4.7 - https://www.drupal.org/sa-core-2018-003 RPM update: drupal8-rpmbuild package dependencies fixed Note that Tenable Network Security has extracted...

Cryptojacking Attack Targets Make-A-Wish Foundation Website

Hackers have been stealing CPU-cycles from visitors to the Make-A-Wish Foundation’s international website in order to mine for Monero cryptocurrency. Researchers said they found the CoinIMP mining script embedded in the non-profit’s website, and that it was taking advantage of the Drupalgeddon 2...

Staying Safe in the Era of Browser-based Cryptocurrency Mining

Qualys Malware Research Labs is announcing the release of Qualys BrowserCheck CoinBlocker Chrome extension to detect and block browser-based cryptocurrency mining, aka cryptojacking. Cryptojacking Cryptojacking attacks leverage the victim system’s resources via malicious JavaScript to mine certai...

Fedora 27 : drupal7 (2018-b9ad458866) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/7.59 - https://www.drupal.org/SA-CORE-2018-004 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Fedora 26 : drupal7 (2018-2359c2ae0e) (Drupalgeddon 2)

https://www.drupal.org/project/drupal/releases/7.59 - https://www.drupal.org/SA-CORE-2018-004 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Debian DLA-1365-1 : drupal7 security update (Drupalgeddon 2)

A remote code execution vulnerability has been found within multiple subsystems of Drupal. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. For Debian 7 'Wheezy', these problems have been fixed in version...

Drupal Drupalgeddon 2 Forms API Property Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal Drupalgeddon 2 Forms API Property Injection', 'Description' = %q This module exploits a Drupal property injection in the Forms API. Drupal...

Drupal Drupalgeddon 2 Forms API Property Injection Exploit

This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source:...

Exploit for Improper Input Validation in Drupal

Drupalgeddon 2 MSF exploit module for Drupalgeddon 2 CVE-201...

Debian DSA-4156-1 : drupal7 - security update (Drupalgeddon 2)

A remote code execution vulnerability has been found in Drupal, a fully-featured content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2018-002 C Tenable Network Security, Inc. The descriptive text and package checks in...

Drupal Drupalgeddon 2 Forms API Property Injection

This module exploits a Drupal property injection in the Forms API. Drupal 6.x, use exploit/unix/webapp/drupal/drupalgeddon2 msf undefineddrupalgeddon2 show actions ...actions... msf undefineddrupalgeddon2 set ACTION msf undefineddrupalgeddon2 show options ...show and set options... msf...