CVE-2018-6574 PoC — Google Go 安全漏洞

Source

https://github.com/zerbaliy3v/cve-2018-6574-exploit

Associated Vulnerability

Title:Google Go 安全漏洞 (CVE-2018-6574)
Description:Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Description

CVE-2018-6574 this vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system by installing a malicious library, this vulnerability was fixed in Go 1.8. 7, 1.9. 4 and 1.10rc2. Golang will build native extensions.

Readme

# cve-2018-6574-exploit
```
gcc -shared -o attack.so -fPIC attack.c
go get github.com/zerbaliy3v/cve-2018-6574-exploit
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!