curl SOCKS5 Proxy Handshake Heap Buffer Overflow

This repository is a proof-of-concept exploit for CVE-2023-38545, a vulnerability in cURL. The repository contains a Dockerfile to set up a controlled environment with a specific vulnerable version of cURL (7.81.0), a Bash script (malicious_redirect_server.sh) that runs a malicious HTTP server on 127.0.0.1:8000, and a Python script (tgsocksproxy.py) that implements a SOCKS5 proxy on 127.0.0.1:1080. The exploit works by having cURL make a request through the local SOCKS5 proxy to the malicious HTTP server, which responds with an oversized Location header, triggering a segmentation fault in cURL. The README provides detailed setup and usage instructions. The exploit demonstrates denial of service and potential memory corruption, but does not provide a weaponized or post-exploitation payload. The main attack vector is local network communication within the Docker container, and the endpoints involved are 127.0.0.1:8000 (malicious HTTP server) and 127.0.0.1:1080 (SOCKS5 proxy).

This repository provides a proof-of-concept (POC) exploit for CVE-2023-38545, a heap buffer overflow vulnerability in libcurl when using a SOCKS5 proxy and following HTTP redirects to long hostnames. The repository contains three files: 'poc.c' (a C program using libcurl to make an HTTP request via a SOCKS5 proxy), 'server.py' (a Python HTTP server that issues a 301 redirect to a URL with an excessively long hostname), and 'readme.md' (detailed instructions and background). The exploit works by running a local SOCKS5 proxy (e.g., via SSH), starting the malicious HTTP server, and executing the C POC, which triggers the vulnerable code path in libcurl. The main attack vector is network-based, requiring the victim to connect to a malicious server through a SOCKS5 proxy. The endpoints involved are local addresses for the proxy and HTTP server. The exploit demonstrates the vulnerability but does not include weaponized payloads or post-exploitation code.

This repository is a proof-of-concept exploit designed to test HTTP clients for vulnerabilities related to handling large or malformed HTTP redirect responses. The structure consists of a C-based client ('client.c') that connects to a local HTTP server via a SOCKS5 proxy, and a Python script ('server/cat.py') that serves a large, crafted HTTP 301 response from 'payload.txt' over a netcat listener on port 8000. The README files provide build and usage instructions. The main exploit capability is to deliver an overlong Location header in an HTTP response, potentially triggering buffer overflows or improper handling in the client. No specific CVE or product is targeted, but the setup is generic for testing HTTP client robustness. The endpoints involved are local (127.1:8000 for the server, 127.0.0.1:10801 for the proxy), and the payload is a text-based HTTP response. The repository contains 5 files, with code in C and Python, and is structured for easy setup and testing of the exploit scenario.

This repository is a Proof of Concept (PoC) exploit for CVE-2023-38545, a heap buffer overflow vulnerability in curl (versions 7.69.0 to 8.3.1) when handling HTTP redirects via a SOCKS5 proxy. The repository contains: - `cve202338545.sh`: The main exploit script, written in bash, which checks the installed curl version and orchestrates the test by connecting to a SOCKS5 proxy and an HTTP server. It parses command-line arguments for proxy and server IPs, runs a crafted curl command, and analyzes the output to determine vulnerability status. - `server.py`: A Python script that implements a simple HTTP server on port 8080. It responds to requests with a 301 redirect, where the Location header contains a very large string, designed to trigger the vulnerability in curl. - `setup_socks5.sh`: Bash script to install and configure the Dante SOCKS5 proxy server on port 1080 without authentication, and set up logging. - `cleanup.sh`: Bash script to remove the Dante SOCKS5 proxy and restore the original configuration. - `README.md`: Detailed instructions for setting up the environment, running the exploit, and interpreting results. The exploit is network-based, requiring the target to connect through a SOCKS5 proxy to an HTTP server that serves the malicious redirect. The scripts are modular, allowing for easy setup and cleanup of the test environment. The endpoints involved are the SOCKS5 proxy on port 1080 and the HTTP server on port 8080. The exploit does not provide a weaponized payload but is a reliable PoC for detection and research purposes.

This repository provides a proof-of-concept (PoC) exploit for CVE-2023-38545, a vulnerability in curl 7.74.0. The structure includes the full curl 7.74.0 source code, build scripts, and documentation. The main exploit steps are documented in the README.md, which instructs the user to build curl with OpenSSL, run a local SOCKS5 proxy (such as Tor on 127.0.0.1:9050), set the ALL_PROXY environment variable, and execute the curl binary with a very long argument (10,000 'A's). This triggers the vulnerability, demonstrating a crash or abnormal behavior as a PoC. The repository does not contain weaponized or automated exploitation code, but provides a clear demonstration of the issue. No hardcoded remote endpoints are present; the only fingerprintable endpoints are the local curl binary and the local SOCKS5 proxy. The exploit is network-based, as it requires network proxying to trigger the vulnerable code path.

This repository contains a Python exploit script (CVE-2023-38545.py) and a README file. The exploit targets a vulnerability in SOCKS proxy servers (CVE-2023-38545). The script connects to a specified SOCKS server and port, then repeatedly sends a malicious HTTP response. The response includes a shell payload in the Location header, which, if executed by the vulnerable server, will open a reverse shell to the attacker's machine using netcat. The payload is a typical bash reverse shell that uses a FIFO file at /tmp/f. The script requires the attacker to specify the target SOCKS server's IP and port, as well as their own IP and port for the reverse shell connection. The README provides a brief description of the exploit's purpose. No detection or fake code is present; this is a functional exploit with a real payload.