dreadlocked / Drupalgeddon2

Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)
579 stars 173 forks source link

[WIP] Initial Refactor #54

Closed KINGSABRI closed 6 years ago

KINGSABRI commented 6 years ago

Hello guys, I've noticed the repository is actively developed and your exploit went viral.

Anyway, the customizable version seems to need more refactoring. I understand the code is not complete yet but at least we should build on top of a clean code.

Your testing is highly appreciated.

Q\ Do you mind if I changed the command line args to be switches?

To Do

These are the main things need to be fixed or implemented before going farther to the core functionalities in different PRs.

g0tmi1k commented 6 years ago

@KINGSABRI Thanks for putting the time in todo this!

I can't see there being too much of an issue with the switches put in place! Note, The customizable version is mainly @dreadlocked's work - tho activity has quietened down a bit on it (so I don't believe you would be stepping on any toes!)

Looking forward to see what you do with it!

KINGSABRI commented 6 years ago

I've updated the main things that should be done on this PR. It's better to keep things simple and separated.

g0tmi1k commented 6 years ago

Cool @KINGSABRI . Nudge me when you would like me to review/meger

dreadlocked commented 6 years ago

Hi, the other script is made for those who just want the simplest version of the exploit. I use it on environments where I need to customize the request and don't want to mess with lot of code.

Of course, the intended exploit for everybody is the g0tmi1k one, all the kudos to him!

Thanks anyway, I'll try to work a bit these days on refactor my simple script, adding optparse may help on args parsing.

KINGSABRI commented 6 years ago

So no intention to have all functionalities of the first script in the second one with keeping the second one reusable as intended?

g0tmi1k commented 6 years ago

I can't say what @dreadlocked's vision is with it. I also personally don't use it :P

I'm more than happy to add any features/pull requests into it tho!

KINGSABRI commented 6 years ago

@g0tmi1k I see what you're saying. The original script is working but it's hard to maintain, IMHO.

This one, on the other hand, is getting better and hopefully well written. So it should be hopefully easier to maintain and easy to add new features.

However, it depends on @dreadlocked's vision. If you're not interested to go farther with that one, please let me know.

g0tmi1k commented 6 years ago

Yup - I agree its hard to maintain. But its 'easier' to use ;) Would you be able to make your tweaks into the original script?

KINGSABRI commented 6 years ago

Yup - I agree its hard to maintain. But its 'easier' to use ;)

it should be almost the same.

Would you be able to make your tweaks into the original script?

I thought that was the goal of the beta version, no? :see_no_evil:

g0tmi1k commented 6 years ago

I thought that was the goal of the beta version, no? 🙈

Who said it was a beta version? The idea is, or at least how I saw it, was manual control/input, the other being the the main, being fully automated.

KINGSABRI commented 6 years ago

Who said it was a beta version? The idea is, or at least how I saw it, was manual control/input, the other being the main, being fully automated.

I see your point, but I belive we can do it both ways. Dreadlocked could be a library and a tool at the sametime. Acutally, many tools I built is that way, a tool that consumes its library. So you can run the tool or require the library. It's a litte bit more work but it's customizable and the tool is easier to expand.

g0tmi1k commented 6 years ago

That sounds perfect to me! Only issue, the work needed in order to pull it off...