CVE-2018-7600 (Drupalgeddon2) Exploit – Python3

DISCLAIMER:
This project is for educational and authorized penetration testing purposes only.
Do NOT use this code on systems you do not own or have explicit written permission to test.
Unauthorized use is illegal and punishable by law.
The author assumes no liability for any misuse of this tool.

Description

This Python3 script exploits the CVE-2018-7600 (Drupalgeddon2) vulnerability — a critical Remote Code Execution (RCE) bug affecting multiple Drupal versions. The vulnerability allows attackers to execute arbitrary commands on a vulnerable server without authentication. This exploit sends a malicious payload via a crafted POST request to the /user/register endpoint, leveraging Drupal's AJAX form rendering to execute system commands.

Additionally, the script includes:

• Reverse Shell Listener – Automatically waits for incoming connections.
• Fully Interactive Shell Upgrade – Allows real-time interaction with the compromised host.

---

Affected Versions

Drupal 7.x and 8.x (prior to patched releases in March 2018) are vulnerable.
For details, see:
🔗 Drupal Security Advisory

---

Requirements