Which version of drupal do you test?

[exeeee]

Which version of drupal do you test?
It does no work for me.
drupal version 7.51 and 8.33.

[RicterZ]

Worked on 8.5.0 and 8.4.5 as far as I tested.

[xuxuedong]

i tested 8.5.0 on my kali+xampp, but i can't found hello.txt, what's your successful signature? 发自我的 iPhone 在 2018年4月13日，13:34，Ricter Zheng <notifications@github.com<mailto:notifications@github.com>> 写道： Worked on 8.5.0 and 8.4.5 as far as I tested. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<#4 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AI8U0CxRsJ69V00WVWQ2BOWQnMfjLFXOks5toDjcgaJpZM4TS3sK>.

[AlbinoDrought]

I'm also having issues running the exploit.py payload from the repo.

Running the netcat reverse shell still works fine for me though: https://gist.github.com/AlbinoDrought/2854ca1b2a9a4f33ca87581cf1e1fdd4

---

The error I'm getting while running the script is:

--2018-04-13 06:18:04--  https://gist.githubusercontent.com/a2u/66680e1f4abac79d654424ffdb1b410d/raw/d417bbfa8137a1ef53124522a87b1ad1d2b8ec96/hello.txt
Resolving gist.githubusercontent.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to gist.githubusercontent.com|151.101.0.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3 [text/plain]
hello.txt: Permission denied

Cannot write to 'hello.txt' (Invalid argument).

---

In the docker4drupal php container, I seem to have write access to autoload.php, not sure what else.

[a2u]

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1

[exeeee]

@RicterZ the hello.txt file is created in the root when you test?

[RicterZ]

I executed assert(phpinfo()) to verify the vulnerability, you can try this. exeeee <notifications@github.com>于2018年4月13日 周五下午4:17写道：

@RicterZ <https://github.com/RicterZ> the hello.txt file is created in the root when you test? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFCbx4zEa3-yOK1XZSzBiGSxrEqEgJAzks5toF8vgaJpZM4TS3sK> .

-- Ricter Z

[exeeee]

@RicterZ ok,I'll try,thank you :)

[MickaelWalter]

@a2u have you tested on Drupal before 7.58 ?

I tracked the execution flow on Drupal 7.57 with XDebug and the payload was finally stripped before being added to #value because of the function form_type_textfield_value (include/form.inc line 2597) called when processing the mail parameter.

This function replaces the array with an empty string if the input is not scalar...

[Namrud]

SO there is no drupalgeddeon which can work for version 7.x?

[hediimisawii]

it Works on 8.3.4 for me and 8.6.x

[xuxuedong]

@0xs3c what's your environment?

[jorrit]

I am also curious whether Drupal 7 is vulnerable in the same way. I hope @a2u can add an exploit to this repository when available.

[gtc51]

PoC 7.x can be found here
dreadlocked/Drupalgeddon2#7