Remote Command Execution via go get in Go (gcc/clang plugin injection)

This repository is a minimal two-file local execution implant disguised as a harmless Go+cgo example. The main Go file uses cgo directives and references a plugin/shared object path './attack.so' via '#cgo CFLAGS: -fplugin=./attack.so'. Its visible logic simply bridges to a C function returning 42 and prints that result, making the program appear benign. The C file defines a constructor function 'malicious' using '__attribute__((constructor))', which causes code to run automatically when the object is loaded. That constructor executes '/usr/local/bin/score ebe92313-0297-4973-823c-c0ba0e2df9a4' through system(). There are no network endpoints, remote targets, or CVE references; the capability is local command execution triggered implicitly through compiler/plugin or shared-object loading behavior. Structurally, the repository appears intended to demonstrate or abuse build-chain/plugin loading to achieve covert execution rather than exploit a specific software vulnerability. The exploit capability is straightforward but operational: automatic execution of a hardcoded local command with benign-looking Go output as cover.

Repository contains a minimal proof-of-concept demonstrating build-time command execution by abusing GCC’s `-fplugin` mechanism through Go cgo build flags. Structure: - `main.go` (Go + cgo): Uses a cgo directive `// #cgo CFLAGS: -fplugin=./attack.so` to force the C compiler (GCC) to load a plugin shared object from the local path `./attack.so` during compilation. The rest of the file defines small C snippets (function pointer bridge and a `fortytwo()` function) and prints `42` to appear benign. - `attack.c` (C): Implements `malicious()` marked with `__attribute__((constructor))`, causing it to run automatically when the shared object is loaded. The constructor calls `system("/usr/local/bin/score a1c53b59-8427-4d82-b710-a230708511ca")`. Exploit capability and purpose: - Primary capability is arbitrary command execution in the compiler/build environment (local/supply-chain style). When a developer/CI system builds the Go program with cgo enabled, GCC loads the specified plugin (`attack.so`), triggering the constructor and executing the embedded command. - No network exploitation is present; the key “target” is the build pipeline and any system that compiles the project. Notable observables: - Local plugin path: `./attack.so`. - Executed command: `/usr/local/bin/score` with UUID argument `a1c53b59-8427-4d82-b710-a230708511ca`.

Repository contains two small files demonstrating build-time/host-side code execution by abusing cgo compiler flags to load a malicious shared object as a compiler plugin. - attack.c: Defines a function malicious() marked with __attribute__((constructor)), ensuring it runs automatically when the compiled shared object is loaded. The constructor calls system("/usr/local/bin/score cd295747-490c-4623-b03a-d89a4bb6193b"), providing immediate local command execution on the machine that loads the library. - main.go: A benign-looking Go program using cgo. It includes a cgo directive `#cgo CFLAGS: -fplugin=./attack.so`, which instructs the C compiler to load `./attack.so` as a plugin during compilation. The Go code then calls a trivial C function returning 42 and prints it, acting as camouflage while the plugin’s constructor payload executes. Notable observables/targets: - Local file path endpoint: /usr/local/bin/score (invoked with a fixed UUID argument). - Relative plugin path: ./attack.so (implied artifact; not present in the repository listing but required for the demonstrated behavior). Overall purpose: a minimal proof-of-malicious-build example (supply-chain style) where compiling the project can trigger arbitrary command execution on the build host via a malicious shared object loaded through cgo/GCC plugin mechanisms.

This repository contains two files: 'exploit.c' (C source) and 'main.go' (Go source). The C file defines a function marked with the constructor attribute, causing it to execute automatically when the shared object is loaded. This function runs the command '/usr/local/bin/score 3f9f4915-ab08-4227-9eba-830c2b3ac417', which is likely used to demonstrate successful code execution (e.g., in a CTF or scoring environment). The Go file is set up to use cgo with a C plugin (compiled from exploit.c as exploit.so). It defines a main function that calls a C function and prints its result, but the key exploit action occurs when the C plugin is loaded, triggering the malicious constructor. The exploit demonstrates arbitrary code execution via a shared object loaded by a Go program, targeting local systems where the attacker can control or inject a malicious plugin. The only fingerprintable endpoint is the file path '/usr/local/bin/score'. Overall, this is a proof-of-concept local privilege escalation or code execution exploit, demonstrating the risk of loading untrusted plugins in Go programs using cgo.

This repository contains two files: 'attack.c' (C source) and 'main.go' (Go source). The C file defines a function marked with the constructor attribute, causing it to execute automatically when the compiled shared object (plugin) is loaded. This function runs the command '/usr/local/bin/score 91e025d6-94e9-4d26-8b86-c00dea0b3129', which is likely used for CTF scoring or flag submission. The Go file demonstrates how to use a C plugin via cgo, referencing the plugin with a CFLAGS directive. The exploit demonstrates how a malicious GCC plugin can execute arbitrary commands on a system where such plugins are loaded, representing a local attack vector. The main fingerprintable endpoint is the file path '/usr/local/bin/score'. The repository serves as a proof-of-concept for exploiting plugin loading mechanisms to achieve code execution.

This repository demonstrates a proof-of-concept exploit for CVE-2018-6574, a vulnerability in the Go programming language's plugin system. The exploit consists of two main files: 'attack.c', which is a C source file for a shared object (attack.so) containing a constructor that executes an arbitrary system command, and 'main.go', a Go program that is configured to load the malicious plugin via the '#cgo CFLAGS: -fplugin=./attack.so' directive. The README provides step-by-step instructions for compiling the malicious shared object and setting up the Go file. The attack is executed when a victim runs 'go get' on the attacker's repository, causing the Go toolchain to load and execute the attacker's plugin, resulting in arbitrary command execution. The exploit targets Go versions prior to 1.10.3 and 1.9.7 on Linux platforms. The main fingerprintable endpoint is the malicious shared object file ('attack.so').

This repository contains two files: 'attack.c' (C source) and 'main.go' (Go source). The C file defines a function marked with the constructor attribute, causing it to execute automatically when the shared object is loaded. This function runs '/usr/local/bin/score' with a specific UUID argument, likely for CTF scoring. The Go file is set up to use cgo and load a C plugin (compiled from attack.c), but its main function simply demonstrates calling a C function and printing its result. The exploit capability lies in the C constructor, which will execute the system command upon loading the shared object, potentially as a plugin or via cgo. The only fingerprintable endpoint is the file path '/usr/local/bin/score'. The repository demonstrates a proof-of-concept for code execution via shared object/plugin loading, with the main purpose being to automate flag submission or scoring in a CTF context.

This repository contains two files: 'attack.c' (C source) and 'main.go' (Go source). The C file defines a function marked as a constructor, which means it will execute automatically when the shared object is loaded. This function runs the command '/usr/local/bin/score afd78b87-2130-4509-be41-e2bc661c338e', likely to submit a flag or score in a CTF or challenge environment. The Go file is set up to use cgo to load a C plugin (compiled from attack.c) and call a function from it. The main attack vector is local code execution via a malicious or specially crafted GCC plugin loaded into a Go program. The only fingerprintable endpoint is the file path '/usr/local/bin/score'. The exploit demonstrates proof-of-concept capability for executing arbitrary commands via a constructor in a shared object, but does not target a specific CVE or product.