Attackers usually dont have to worry much about Drupal administrators applying patches. The majority of exploit attempts I see in our honeypots use pretty ancient vulnerabilities. So I was happy to see a script kiddie go the extra mile and use a vulnerabilityreleased in July of this year [1] [2].
The vulnerability itself is very straight forward. The attacker can send arbitrary php code that will be executed on the server. No special encoding beyond URL encoding appears to be required.
Here is the exploit string as found in my logs:
GET /?q=taxonomy_vocabulary//passthru/printf+%22printf%5C040%5C047%5C134%5C060%5C066%5C061%5C134%5C061%5C060%5C065%5C134%5C061%5C061%5C066%5C134%5C061%5C061%5C062%5C134%5C061%5C061%5C066%5C134%5C061%5C062%5C060%5C134%5C061%5C060%5C062%5C134%5C061%5C062%5C065%5C134%5C061%5C066%5C062%5C134%5C061%5C062%5C063%5C047%22%7Csh+
Decoding this leads to:
printf\040\047\134\060\066\061\134\061\060\065\134\061\061\066\134\061\061\062\134\061\061\066\134\061\062\060\134\061\060\062\134\061\062\065\134\061\066\062\134\061\062\063\047|sh
which is actually double octal encoded and would just print the string 1ENJNPBUrS, likely trying to find indicators of vulnerable systems.
So far in our honeypot, I got 44 attempts today from 16 different IPs. Expliot attempts go back to July, just after the vulnerability was announced. Earlier versions use a slightly different test:
GET /?q=taxonomy_vocabulary/XuMWvA8KTq/passthru/echo%20ktKPt14N9p HTTP/1.1
So they skip the octal/URL encoding part.
I used Bings IP address search to check some of the IP addresses attacking the honeypot (for example, try a Bing search for ip:117.240.207.43, but dont click on the result. The site is likely compromised). Most of the IPs appear to be running Drupal sites and are likely exploited and used to scan for more victims.
In my quick sampling, I didnt find any obvious malicious content on these sites. I would have expected some advertisement or maybe even malware, but maybe they are still building out their network.
[1]https://www.mehmetince.net/exploit/drupal-restws-module-7x-remote-php-code-execution
[2]https://www.drupal.org/node/2765567