Attackers usually don't have to worry much about Drupal administrators applying patches. The majority of exploit attempts I see in our honeypots use pretty ancient vulnerabilities. So I was happy to see a script kiddie go the extra mile and use a vulnerability released in July of this year [1] [2].

The vulnerability itself is very straight forward. The attacker can send arbitrary php code that will be executed on the server. No special encoding beyond URL encoding appears to be required.

Here is the exploit string as found in my logs:

GET /?q=taxonomy_vocabulary//passthru/printf+%22printf%5C040%5C047%5C134%5C060%5C066%5C061%5C134%5C061%5C060%5C065%5C134%5C061%5C061%5C066%5C134%5C061%5C061%5C062%5C134%5C061%5C061%5C066%5C134%5C061%5C062%5C060%5C134%5C061%5C060%5C062%5C134%5C061%5C062%5C065%5C134%5C061%5C066%5C062%5C134%5C061%5C062%5C063%5C047%22%7Csh+

Decoding this leads to:

"printf\040\047\134\060\066\061\134\061\060\065\134\061\061\066\134\061\061\062\134\061\061\066\134\061\062\060\134\061\060\062\134\061\062\065\134\061\066\062\134\061\062\063\047"|sh

which is actually "double octal encoded" and would just print the string "1ENJNPBUrS", likely trying to find indicators of vulnerable systems.

So far in our honeypot, I got 44 attempts today from 16 different IPs. Expliot attempts go back to July, just after the vulnerability was announced. Earlier versions use a slightly different test:

GET /?q=taxonomy_vocabulary/XuMWvA8KTq/passthru/echo%20ktKPt14N9p HTTP/1.1

So they skip the octal/URL encoding part.

I used Bing's IP address search to check some of the IP addresses attacking the honeypot (for example, try a Bing search for "ip:117.240.207.43", but don't click on the result. The site is likely compromised). Most of the IPs appear to be running Drupal sites and are likely exploited and used to scan for more victims.

In my quick sampling, I didn't find any obvious malicious content on these sites. I would have expected some advertisement or maybe even malware, but maybe they are still building out their network.

[1] https://www.mehmetince.net/exploit/drupal-restws-module-7x-remote-php-code-execution
[2] https://www.drupal.org/node/2765567

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn