add cve-2021-22205 #34
Conversation
There was a problem hiding this comment.
It fails to run:
2024-11-21 11:41:35,798 - INFO - [ubuntu] Executing 'python /opt/CVE-2021-22205/poc.py http://localhost:8080 "touch /tmp/success"'...
2024-11-21 11:44:38,346 - CRITICAL - [main] Command failed: <UnexpectedExit: cmd='python /opt/CVE-2021-22205/poc.py http://localhost:8080 "touch /tmp/success"' exited=1>
CVE-2021-22205/cvex.yml
Outdated
| @@ -0,0 +1,6 @@ | |||
| blueprint: ubuntu2204 | |||
There was a problem hiding this comment.
Use the ubuntu2204-ubuntu2204 blueprint. Install and run the Docker containers on ubuntu1, copy the exploit to ubuntu2, run the exploit on ubuntu2 that would attack ubuntu1. Make sure that router_raw.pcap captures the network traffic. The goal is to get the traffic!
| - DB_EXTENSION=pg_trgm,btree_gist | ||
|
|
||
| gitlab: | ||
| image: vulhub/gitlab:13.10.1 |
There was a problem hiding this comment.
Please download the Docker image and keep it in the data folder. Install it from the file.
|
|
||
| services: | ||
| redis: | ||
| image: redis:5.0.9-alpine |
There was a problem hiding this comment.
Do we need this specific version of redis? If we do, then please download the Docker image and keep it in the data folder. Install it from the file.
There was a problem hiding this comment.
I'm asking once again: please either download this specific version of redis and install it from file, or pull the latest version of redis.
CVE-2021-22205/ubuntu.yml
Outdated
| dest: /opt/CVE-2021-22205/ | ||
|
|
||
| - name: Start Docker Compose services | ||
| command: docker compose up -d --build |
There was a problem hiding this comment.
Use community.docker.docker_compose instead of shell commands
CVE-2021-22205/ubuntu.yml
Outdated
| - python3.11-distutils | ||
| state: present | ||
|
|
||
| - name: Install pip for Python 3.11 |
There was a problem hiding this comment.
Where pip is used? I don't see that.
CVE-2021-22205/cvex.yml
Outdated
| ubuntu: | ||
| playbook: ubuntu.yml | ||
| command: | ||
| - "sudo docker ps -a" |
There was a problem hiding this comment.
I'd remove that. Let's keep it clean, without debugging commands.
CVE-2021-22205/cvex.yml
Outdated
| playbook: ubuntu.yml | ||
| command: | ||
| - "sudo docker ps -a" | ||
| - "python /opt/CVE-2021-22205/poc.py http://localhost:8080 \"touch /tmp/success\"" |
There was a problem hiding this comment.
In the new version of cvex.yml based off ubuntu2204-ubuntu2204 please also run ls /tmp/success on ubuntu1. cvex.yml will look like this:
ubuntu2:
...
command: "python /opt/CVE-2021-22205/poc.py http://localhost:8080 \"touch /tmp/success\""
...
ubuntu1:
...
command: ls /tmp/success
This way we can verify that the file has been successfully created.
|
Hi Oleg, |
| ubuntu2: | ||
| playbook: ubuntu2.yml | ||
| command: | ||
| - "sleep 180" |
There was a problem hiding this comment.
Reliance on sleeps like that is a poor design choice unless there is absolutely no way around it. Is there a way to check that GitLab is ready to be used? Please move this check to ubuntu1.yml.
| playbook: ubuntu2.yml | ||
| command: | ||
| - "sleep 180" | ||
| - "python /opt/CVE-2021-22205/poc.py http://ubuntu1:8080 \"touch /tmp/success\"" |
There was a problem hiding this comment.
python does not exist on ubuntu1, therefore this command will always fail to execute. I was able to execute this script with python3:
vagrant@ubuntu2:~$ python3 /opt/CVE-2021-22205/poc.py http://ubuntu1:8080 "touch /tmp/success"
finish test
But then when I execute ls /tmp/success on ubuntu1, it shows me that /tmp/success does not exist. Looks like the exploit doesn't work.
|
|
||
| services: | ||
| redis: | ||
| image: redis:5.0.9-alpine |
There was a problem hiding this comment.
I'm asking once again: please either download this specific version of redis and install it from file, or pull the latest version of redis.
| enabled: yes | ||
|
|
||
| - name: Verify Docker Compose installation | ||
| command: docker compose version |
There was a problem hiding this comment.
Please use built-in Docker commands: https://docs.ansible.com/ansible/latest/collections/community/docker/index.html
| command: docker load -i /opt/CVE-2021-22205/gitlab-13.10.1.tar | ||
|
|
||
| - name: Start Docker Compose services | ||
| command: docker compose up -d --build |
There was a problem hiding this comment.
Please use built-in Docker commands: https://docs.ansible.com/ansible/latest/collections/community/docker/index.html
|
@olegbck I've noticed that the key to whether the exploit succeeds depends on whether the GitLab service can start normally, and this is quite random - whether it starts within a fixed time and whether it starts correctly are both very difficult to determine. Even worse, I am unable to reproduce this exploit locally now, despite not having made any modifications. I spent few hours and finally decided to give up and switch to CVE-2012-2122 instead. #42 |
I use a
sleep(180)to wait the gitlab for setup