Dungsocool/CVE-2018-7600
PoC files
8 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A technical writeup documenting the analysis and exploitation of CVE-2018-7600 (Drupalgeddon2) against a Drupal 8.5.0 target. The document describes system fingerprinting, verification of vulnerable version, assessment of the installer state, and a workaround to install Drupal with SQLite to enable the vulnerable endpoint. It includes a curl command demonstrating RCE via the Form API and analyzes the response confirming code execution as www-data.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a single README.md file containing a lab write-up for exploiting CVE-2018-7600 (Drupalgeddon2). The text describes reconnaissance, version fingerprinting, installer-state analysis, and a final curl command that achieves RCE via the Drupal Form API. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed content. The artifact is a documentation-only repository with no executable PoC code.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a detailed technical narrative of vulnerability analysis and exploitation steps, including commands and their output. It does not contain executable exploit or scanner code; it is a documentation writeup.
README.md:1-214Requirements
- Target must be running a vulnerable version of Drupal (e.g., 8.5.0) without the CVE-2018-7600 patch.
README.md:44-54 - A Drupal endpoint using the Form API (e.g., /user/register) must be accessible and not redirect to the installer.
README.md:120-128
Observed behavior
- The document describes using curl to send a crafted POST request to /user/register with render array injection payloads, resulting in the execution of the 'id' command on the server and returning the output 'uid=33(www-data)'.
README.md:164-175
Behaviors behind the backdoor verdict
Observables
- Exploit Command
- curl -v "http://192.168.3.137:8011/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax" -H "X-Requested-With: XMLHttpRequest" -H "Content-Type: application/x-www-form-urlencoded" --data "form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=passthru&mail[#type]=markup&mail[#markup]=id"This is the documented exploit payload targeting the stated CVE-2018-7600 vulnerability. It uses the standard render array injection technique to execute 'id' on the target Drupal instance. The command is consistent with normal PoC behavior for this CVE and does not exhibit backdoor characteristics.
README.md:165-168 - Target Ip
- 192.168.3.137Internal lab IP address used as the target for the documented exploit. This is a private RFC 1918 address typical of lab environments and does not indicate exfiltration or malicious intent.
README.md:27
What the analysis did not establish
- Only one text file (README.md) was provided; 7 non-text media files (images) were omitted, so visual content referenced in the writeup is unavailable.
- The artifact is a static document; no code was executed to verify the described behavior.
- Seven non-text media files (images) totaling 651,106 bytes were present in the repository but were not analyzed. They are referenced as screenshots in the README and are unlikely to contain executable code, but their content was not reviewed.
- The repository contains no executable source code, scripts, or binaries; the review is limited to the documentation text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.