|
1 | | -# Docker |
| 1 | +# Remote code execution in librelp (CVE-2018-1000140) |
2 | 2 |
|
3 | | -To build and run the Dockerfile: |
| 3 | +This directory contains a proof-of-concept exploit for a remote code execution vulnerability in [librelp](https://www.rsyslog.com/librelp/). The vulnerability was fixed in librelp version [1.2.15](https://www.rsyslog.com/librelp-1-2-15/), released on 2018-03-22. |
4 | 4 |
|
5 | | -``` |
6 | | -docker build . -t kev-rsyslog |
7 | | -docker network create -d bridge --subnet 172.25.0.0/16 kev-rsyslog-network |
8 | | -``` |
9 | | - |
10 | | -In terminal 1, start a container for the server: |
11 | | - |
12 | | -``` |
13 | | -docker run --network=kev-rsyslog-network --ip=172.25.0.10 -h rsyslog-server -i -t kev-rsyslog |
14 | | -``` |
15 | | - |
16 | | -If you want to use `gdb` to see the server crash, then start the server like this: |
17 | | - |
18 | | -``` |
19 | | -docker run --network=kev-rsyslog-network --ip=172.25.0.10 -h rsyslog-server --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -i -t kev-rsyslog |
20 | | -``` |
21 | | - |
22 | | -In terminal 2, start a container for the benevolent client: |
23 | | - |
24 | | -``` |
25 | | -docker run --network=kev-rsyslog-network --ip=172.25.0.20 -h rsyslog-client -i -t kev-rsyslog |
26 | | -``` |
27 | | - |
28 | | -In the docker container for the benevolent client (terminal 1): |
29 | | - |
30 | | -``` |
31 | | -sudo rsyslogd -f benevolent/rsyslog-server.conf |
32 | | -``` |
33 | | - |
34 | | -In the docker container for the server (terminal 2), start the benevolent client: |
35 | | - |
36 | | -``` |
37 | | -sudo rsyslogd -f benevolent/rsyslog-client.conf |
38 | | -``` |
39 | | - |
40 | | -To see that the client has connected to the server: |
41 | | - |
42 | | -``` |
43 | | -sudo netstat -ntp |
44 | | -``` |
45 | | - |
46 | | -This will show something like this: |
47 | | - |
48 | | -``` |
49 | | -Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name |
50 | | -tcp 90 0 172.25.0.20:38866 172.25.0.10:2514 ESTABLISHED 28/rsyslogd |
51 | | -``` |
52 | | - |
53 | | -In terminal 3, start a container for the malicious client: |
54 | | - |
55 | | -``` |
56 | | -docker run --network=kev-rsyslog-network --ip=172.25.0.30 -h rsyslog-client -i -t kev-rsyslog |
57 | | -``` |
58 | | - |
59 | | -In the docker container for the malicious client (terminal 3): |
60 | | - |
61 | | -``` |
62 | | -sudo rsyslogd -f malicious/rsyslog-client.conf |
63 | | -``` |
64 | | - |
65 | | - |
66 | | -Instructions for using TLS with rsyslog: |
67 | | - |
68 | | -https://www.rsyslog.com/using-tls-with-relp/ |
| 5 | +For more information about the vulnerability and for instructions on how to run the proof-of-concept exploit, please see our blog post which is published on both [Rainer Gerhards's blog](https://rainer.gerhards.net/how-we-found-and-fixed-cve-in-librelp) and on the [LGTM blog](https://lgtm.com/blog/rsyslog_snprintf_CVE-2018-1000140). |
0 commit comments