CVE-2024-24787-PoC

CVE-2024-24787-PoC Darwin上では、CGOを含むGoモジュールをビルドする際にApple版のldを使用すると、"cgo LDFLAGS"ディレクティブ内の-ltolibraryフラグの使用により、任意のコード実行が発生する可能性があります。 これは私のバグではありません。私はそのPoCを作成しただけです。 参照 https://pkg.go.dev/vuln/GO-2024-2825...

Go-Get-RCE-CVE-2018-6574-POC

CVE-2018-6574 PoC リンク https://nvd.nist.gov/vuln/detail/CVE-2018-6574 http://blog.nsfocus.net/cve-2018-6574/ 実行 root@kitploit: go get github.com/neargle/CVE-2018-6574-POC 詳細 ペイロードは: https://github.com/neargle/CVE-2018-6574-POC/blob/master/calc.cL10 現在、CGOの機能により全プラットフォームをサポートしています。Linuxで go get すると...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Astra Linux - Vulnerability in Golang-1.19

The “//line” directive can be used to bypass the restrictions on the “//go:cgo” directives, allowing for the passing of blocked linker and compiler flags during compilation. This can lead to the execution of arbitrary code when running “go build”. The “//line” directive requires the absolute path...

Astra Linux – Vulnerability in Golang-1.19

The go command may generate unexpected code during build time when using cgo. This can lead to unexpected behavior when running a Go program that uses cgo. This issue may occur when running a trusted module that contains directories with newline characters in their names. Modules retrieved using...

Astra Linux - Vulnerability in Golang-1.19

The go command may execute arbitrary code during compilation when using cgo. This can occur when running “go get” on a malicious module, or when running any other command that compiles unauthorized code. This issue can be triggered by linker flags, specified via the cgo LDFLAGS directive. The...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2018-6574

CVE-2018-6574 再現手順: 1. 悪意のあるコマンド（リバースシェル）を含む .c ファイルを作成します: root@kitploit: include include static void malicious attributeconstructor; void malicious system""; 2. GCC でコンパイルします。ターゲットと同じアーキテクチャと OS（例: Linux x8664）でコンパイルする必要があります: root@kitploit: gcc -shared -o attack.so -fPIC attack.c 3. Go...

CVE-2018-6574

CVE-2018-6574 Golang go get 命令的远程命令执行漏洞利用。 介绍 当你使用 go get 获取一个包时，Go 的设计是构建并安装该包，而不运行其中的任何代码。其意图是，你可以安全地获取、构建甚至安装 Go 包，而完全不需要信任它们。理论上，这对 Go 工具链来说似乎是一项简单的任务，但实际上，这是一个真正的挑战。go get 在幕后做了很多工作，包括以受包配置严重影响的方式调用第三方工具，如 git 和 clang。确保这些调用的安全性是一场持久战，而 Go 尚未完全获胜。 当 cgo 启用时，“go get” 期间的构建步骤会调用宿主机的 C 编译器（gcc ...

CVE-2018-6574

CVE-2018-6574 POC CVE-2018-6574 用のエクスプロイト POC コンパイル 1. 以下の内容でエクスプロイトファイルを作成します: root@kitploit: include include static void malicious attributeconstructor; void malicious system"COMMAND"; 2. コンパイルします: root@kitploit: gcc -shared -o exploit.so -fPIC exploit.c 3. 最後に、cgo にプラグインを使用させる Go コードが必要です:...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-3264)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 When processing HTTP/...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...