Skip to content

Instantly share code, notes, and snippets.

@joshkoenig

joshkoenig/gist:fdd6a0b382c813ab7c33

Created October 20, 2014 16:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save joshkoenig/fdd6a0b382c813ab7c33 to your computer and use it in GitHub Desktop.
Save joshkoenig/fdd6a0b382c813ab7c33 to your computer and use it in GitHub Desktop.
Download ZIP
Drupal SA-CORE-2014-005 "drplsys" user attack
Raw
gistfile1.txt
Here's the latest attack we're seeing:
insert into users values (99992, 'drplsys', '$S$DeaaG6rBb1N73WEtKMW.cvIwP3f9/VP1M9ZJVu1mRiaH/bGu1bTK', '4585856489@mail.com', '', '', NULL,0,0,0,1,NULL,'',0,'',NULL);
Will create a fake user account. There doesn't appear to be a follow-on attack to use it for anything, yet.
Stay alert. Stay alive.
@xurizaemon
Copy link

Added to Drupalgeddon checks, thanks Josh.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment