关联漏洞
标题：
Drupal 安全漏洞
(CVE-2018-7600)
描述：Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。 Drupal中带有默认或通用模块配置的多个子系统存在安全漏洞。远程攻击者可利用该漏洞执行任意代码。以下版本受到影响：Drupal 7.58之前版本，8.3.9之前的8.x版本，8.4.6之前的8.4.x版本，8.5.1之前的8.5.x版本。
描述
Demonstration on exploitation on Drupal 7.57 (CVE-2018-7600) with and without WAF(Web Application Firewall)
介绍
# Drupal-Exploit-Lab
Demonstration on exploitation on Drupal 7.57 (CVE-2018-7600) with and without WAF(Web Application Firewall)
## Description
The project shows how the exploitation of Drupal 7.57 looks like in two different scenarios:
1. **Unprotected server** → successful exploitation with Metasploit and obtaining a Meterpreter shell.
2. **Protected server** → the same vulnerable version, but with protection applied (ModSecurity + OWASP CRS) → the exploitation fails.
## Technologies and Tools
- **Operating Systems:** Ubuntu Server 16.04 (unprotected), Ubuntu Server 22.04 (protected), Kali Linux
- **Web Server:** Apache2
- **Database:** MySQL / MariaDB
- **PHP:** PHP 7.0 and PHP 7.4 (depending on the scenario)
- **Drupal:** version 7.57
- **Security Tools:** ModSecurity
- **Attack:** Metasploit Framework (drupalgeddon2 module)
## Authors
- Sara Dobrevska
- Tеа Celikiк
**Note:** All activities were performed in a controlled lab environment.
It is prohibited to use these commands outside of isolated test environments.
文件快照
[4.0K] /data/pocs/901b744d65294d6802d3f287cea0245e4df47eee
├── [4.3K] commands_protected.md
├── [2.5K] commands_unprotected.md
├── [1.0K] README.md
├── [1.4M] Експлоатација на Drupal 7.pptx
└── [5.6M] Експлоатација на Drupal - Етичко хакирање.pdf
0 directories, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。