CVE-2018-6574 PoC — Google Go 安全漏洞

Source

Associated Vulnerability

Description

The issue is due to the fact that when installing a package, Golang will build native extensions. This can be used to pass additional flags to the compiler to gain code execution. For example, CFLAGS can be used.

Readme

# CVE-2018-6574-go-get-RCE
The issue is due to the fact that when installing a package, Golang will build native extensions. This can be used to pass additional flags to the compiler to gain code execution. For example, CFLAGS can be used.

You can build it using the following command:
$ gcc -shared -o attack.so -fPIC attack.c
Once you host your full payload on Github, you should be able to pass the package link to the victim.

File Snapshot

 [4.0K]  /data/pocs/7a7902d7aa59dd073d7d14d0f0a2cc6b333f5666
├── [ 187]  attack.c
├── [ 15K]  attack.so
├── [ 333]  main.go
└── [ 432]  README.md

0 directories, 4 files

Remarks