This repository contains a completely original and self-developed Proof-of-Concept (PoC) for CVE-2018-7600, also known as Drupalgeddon 2 — a critical remote code execution vulnerability affecting Drupal 7 and 8 core versions.# Drupalgeddon2 Python Exploit (CVE-2018-7600)
This repository contains a Python-based proof-of-concept exploit for the critical remote code execution vulnerability in Drupal, known as Drupalgeddon2 (CVE-2018-7600). This script is designed for educational purposes and for security professionals to use in authorized penetration testing scenarios.
## 📜 Disclaimer
This tool is intended for legal and ethical purposes only. Using this script on any system without explicit permission from the owner is illegal. The author and contributors are not responsible for any misuse or damage caused by this script. Use at your own risk.
## Vulnerability Details
- **CVE ID**: CVE-2018-7600
- **Description**: Drupal versions before 7.58, 8.3.9, 8.4.6, and 8.5.1 have a remote code execution vulnerability due to insufficient sanitization of array values in form API (FAPI) AJAX requests. This allows an unauthenticated attacker to execute arbitrary code on the target server.
- **Affected Versions**:
- Drupal Core 7.x versions prior to 7.58
- Drupal Core 8.3.x versions prior to 8.3.9
- Drupal Core 8.4.x versions prior to 8.4.6
- Drupal Core 8.5.x versions prior to 8.5.1
## ✨ Features
- **Single or Multiple Targets**: Scan a single URL or provide a list of URLs from a file.
- **Custom Command Execution**: Specify the command to be executed on the target system.
- **Multithreading**: Run scans on multiple targets concurrently for faster assessments.
- **Vulnerability Check**: Performs a basic check to identify if a target is running Drupal before attempting the exploit.
- **Output Logging**: Save the results of the scan to a log file.
- **Colored CLI**: Clean, color-coded output for better readability.
## ⚙️ Requirements
- Python 3.x
- `requests` library
- `colorama` library
## 🚀 Installation
1. Clone the repository:
```bash
git clone <repository-url>
cd <repository-directory>
```
2. Install the required Python packages:
```bash
pip install -r requirements.txt
```
(Alternatively, install them manually):
```bash
pip install requests colorama
```
## Usage
The script offers several command-line arguments to customize its execution.
### Basic Examples
1. **Exploit a single target with the default command (`whoami`)**:
```bash
python3 drupalgeddon2.py -t http://example.com
```
2. **Exploit a single target with a custom command (e.g., `ls -la`)**:
```bash
python3 drupalgeddon2.py -t http://vulnerable-drupal.site -c "ls -la"
```
3. **Scan a list of targets from a file**:
Create a file named `targets.txt` with one URL per line:
```
http://site1.com
https://site2.org
http://site3.net
```
Then run the script:
```bash
python3 drupalgeddon2.py -l targets.txt
```
### Advanced Usage
4. **Scan a list with a custom command and increased threads**:
```bash
python3 drupalgeddon2.py -l targets.txt -c "uname -a" -T 10
```
5. **Save the output to a log file**:
```bash
python3 drupalgeddon2.py -l targets.txt -o scan_results.log
```
### Full List of Arguments
| Argument | Short | Description | Default |
|----------------|-------|--------------------------------------------------|---------|
| `--target` | `-t` | A single target URL. | - |
| `--list` | `-l` | Path to a file containing a list of target URLs. | - |
| `--command` | `-c` | The command to execute on the target. | `whoami`|
| `--threads` | `-T` | Number of concurrent threads to use. | 5 |
| `--output` | `-o` | File to log the output to. | - |
| `--timeout` | | Request timeout in seconds. | 15 |
[4.0K] /data/pocs/ddc7f06f524bfa7217dd068e5c1c1e2676f8b187
├── [7.2K] drupalgeddon2.py
├── [3.7K] README.md
├── [1.3K] scan_results.log
└── [ 111] targets.txt
0 directories, 4 files