CVE-2016-4971

This exploit demonstrates how GNU Wget before 1.18 can be tricked into saving arbitrary files via a crafted HTTP 30X redirect to an FTP server, potentially leading to remote code execution or privilege escalation if wget is run from a sensitive directory or via a cronjob.

This exploit leverages a vulnerability in GNU Wget < 1.18 (CVE-2016-4971) to achieve arbitrary file upload and remote code execution. It sets up an HTTP server that redirects Wget requests to an FTP server, exploiting the FTP redirect vulnerability to upload a file (e.g., .bash_profile) to the target system.

This repository contains a functional exploit for CVE-2016-4971, which leverages a vulnerability in Wget versions 1.18 and 1.14-13.el7 to achieve arbitrary file upload via FTP redirection. The exploit uses a Python-based HTTP server to serve a malicious .wgetrc file and a cronjob payload, leading to remote code execution.

This repository contains a functional exploit for CVE-2016-4971, targeting Wget versions before 1.18. The exploit leverages a vulnerability in Wget's handling of FTP-to-HTTP redirects to write arbitrary files, specifically used here to inject SSH keys for unauthorized access.

This repository contains a functional exploit for CVE-2016-4971, which abuses wget's handling of HTTP-to-FTP redirects to write arbitrary files. The PoC sets up an HTTP server that redirects vulnerable wget clients to an FTP server, which then serves a malicious .bash_profile file.