CVE-2018-7600 PoC — Drupal 安全漏洞

Source

Associated Vulnerability

Description

Demonstration on exploitation on Drupal 7.57 (CVE-2018-7600) with and without WAF(Web Application Firewall) 

Readme

# Drupal-Exploit-Lab
Demonstration on exploitation on Drupal 7.57 (CVE-2018-7600) with and without WAF(Web Application Firewall) 

## Description
The project shows how the exploitation of Drupal 7.57 looks like in two different scenarios:
1. **Unprotected server** → successful exploitation with Metasploit and obtaining a Meterpreter shell.
2. **Protected server** → the same vulnerable version, but with protection applied (ModSecurity + OWASP CRS) → the exploitation fails.

## Technologies and Tools
- **Operating Systems:** Ubuntu Server 16.04 (unprotected), Ubuntu Server 22.04 (protected), Kali Linux
- **Web Server:** Apache2
- **Database:** MySQL / MariaDB
- **PHP:** PHP 7.0 and PHP 7.4 (depending on the scenario)
- **Drupal:** version 7.57
- **Security Tools:** ModSecurity
- **Attack:** Metasploit Framework (drupalgeddon2 module)

## Authors
- Sara Dobrevska 
- Tеа Celikiк 

**Note:** All activities were performed in a controlled lab environment.
It is prohibited to use these commands outside of isolated test environments.

File Snapshot

 [4.0K]  /data/pocs/901b744d65294d6802d3f287cea0245e4df47eee
├── [4.3K]  commands_protected.md
├── [2.5K]  commands_unprotected.md
├── [1.0K]  README.md
├── [   0]  Експлоатација на Drupal 7.pptx
└── [2.1M]  Експлоатација на Drupal - Етичко хакирање.pdf

1 directory, 5 files

Remarks