Git recursive clone submodule hook remote code execution

Repository contains a single Bash script at y/hooks/post-checkout intended to be used as a Git post-checkout hook. When triggered by a checkout operation, it (1) writes a timestamped proof file to /tmp (including the current username) to confirm code execution, and (2) attempts to establish a reverse shell back to 10.10.10.10:4444 using two methods: a bash built-in /dev/tcp one-liner and a more reliable netcat+mkfifo pipeline. This is an operational RCE payload delivered via Git hook execution rather than a CVE-specific exploit; success depends on the hook being installed/enabled in the victim’s local Git hooks and on outbound network access to the callback IP/port.

Repository purpose: a small submodule repository intended to support exploitation of Git CVE-2024-32002 (hook execution via crafted submodule/checkout behavior). It contains a malicious `post-checkout` hook (duplicated at `y/hooks/post-checkout`) that executes automatically when the hook is triggered. Structure: - README.md: states it is a submodule repo for a Backup Exec CVE-2024-32002 exploit. - post-checkout: POSIX shell script that runs an embedded Python3 payload. - y/hooks/post-checkout: identical copy of the hook, likely to facilitate placing the hook into a victim’s `.git/hooks/` through path/symlink tricks used in CVE-2024-32002 exploit chains. Exploit capabilities: - Achieves local code execution in the context of the user running Git operations that trigger `post-checkout`. - Runs `/readflag` under a pseudo-terminal (PTY), captures its output, detects an arithmetic expression line, and waits for the prompt `input your answer:`. - Uses `eval()` on the captured expression (restricted by regex to digits, parentheses, +/-, and whitespace) to compute the answer, sends it back to the process, then continues to drain output. - Mirrors all output to stderr so it is visible in the parent `git clone` output, effectively exfiltrating the command output. Notable observations: - No network I/O is present; the payload is purely local. - The hardcoded `/readflag` indicates this is tailored for a CTF/demo environment rather than a general-purpose post-exploitation payload (though it demonstrates arbitrary command execution via hooks).

This repository contains two files: a README.md and a shell script located at y/hooks/post-checkout. The README is a placeholder and does not contain technical information. The main exploit logic is in the post-checkout shell script, which demonstrates arbitrary code execution for CVE-2024-32002. When executed, the script creates a proof file in /tmp/ containing the current username and timestamp, and attempts to open it with notepad.exe if available. This is a proof-of-concept (POC) exploit that demonstrates local code execution, likely as a post-exploitation hook. No network endpoints or remote attack vectors are present; the exploit operates entirely on the local system. The only fingerprintable endpoint is the proof file written to /tmp/. The script is written in bash and is not part of any known exploit framework.

This repository is a Proof-of-Concept (PoC) exploit for CVE-2024-32002, a critical vulnerability in Git (up to version 2.45.0) that allows path injection via submodules. The exploit demonstrates how an attacker can manipulate the .gitmodules file and use symbolic links to inject files into the internal .git directory, specifically to place a malicious Git hook (post-checkout) that is executed during normal repository operations. The repository contains three files: a Dockerfile that sets up a vulnerable environment with Git 2.45.0, a README.md with detailed background and instructions, and setup.sh, a Bash script that automates the exploit steps. The exploit is triggered by cloning the malicious repository with submodules, resulting in the execution of the attacker's code (writing to /tmp/teste.txt) via the malicious hook. The PoC is intended for educational and research purposes and highlights the risk of using outdated Git versions in automated or shared environments.

This repository is a Proof of Concept (PoC) exploit for CVE-2024-32002, a Remote Code Execution (RCE) vulnerability in Git submodules. The exploit demonstrates how an attacker can leverage malicious Git repositories and submodules to achieve code execution on a victim's machine when they perform a recursive clone operation. The repository contains a Bash script (poc.sh) that automates the setup of three Git repositories (hulk.git, submod.git, smash.git), configures a malicious post-checkout hook containing the payload (by default, opening Calculator on macOS), and chains the repositories via submodules and symlinks. The README.md provides detailed setup and usage instructions. The exploit is specifically tested on macOS, but the technique could be adapted for other platforms. The main attack vector is network-based, requiring the victim to clone a malicious repository. The endpoints involved are the Git repository URLs and the file path to the payload. The repository is structured as a PoC, with clear instructions and a single Bash script implementing the exploit logic.

This repository is a proof-of-concept (PoC) exploit for CVE-2024-32002, a vulnerability in Git that allows remote code execution (RCE) during a 'git clone' operation on case-insensitive filesystems (Windows and MacOS). The exploit leverages Git submodules with specially crafted paths and symlinks to inject a malicious 'post-checkout' hook into the cloned repository's .git directory. When the repository is cloned recursively, the malicious hook is executed, resulting in arbitrary code execution on the victim's machine. The payload demonstrates this by creating a marker file ('/tmp/pwnd') and attempting to launch the calculator application on both Windows and MacOS. The repository includes a Bash script ('create_poc.sh') that automates the setup of the malicious repository and submodule, as well as the malicious hook itself ('post-checkout'). No network endpoints are involved; the attack vector is local, triggered by user interaction with a malicious repository. The exploit is intended for educational purposes and should only be used in controlled environments.

This repository is a Proof of Concept (PoC) exploit for CVE-2024-32002, a Remote Code Execution (RCE) vulnerability in Git's handling of submodules. The exploit consists of a Bash script (poc.sh) and a README.md with setup instructions. The script automates the creation and configuration of three Git repositories: 'hulk.git' (malicious submodule with a post-checkout hook containing the payload), 'submod.git' (contains the submodule), and 'smash.git' (the final repository to be cloned by the victim). The exploit works by having the victim perform a recursive clone of the 'smash.git' repository, which triggers the malicious submodule and executes the payload (by default, opening Calculator on macOS). The payload can be replaced with any arbitrary command, demonstrating the potential for arbitrary code execution. The attack vector is network-based, requiring the victim to clone a repository controlled by the attacker. The PoC is specifically tested on macOS, but the technique may be adaptable to other platforms. The repository is structured as a typical PoC, with clear instructions and a single Bash script implementing the exploit logic.

This repository demonstrates a proof-of-concept exploit for CVE-2024-32002, a vulnerability in Git that allows remote code execution via malicious hooks during a 'git clone' operation. The repository contains two files: a README.md explaining the context and a Bash script (y/hooks/post-checkout) that serves as the malicious hook. When executed, the hook creates a marker file at /tmp/pwnd and attempts to launch the system calculator on both Windows and macOS, demonstrating arbitrary code execution. The exploit targets users who clone a repository with a malicious post-checkout hook and have their Git configuration set to allow hook execution. No network endpoints are present; the attack vector is local code execution triggered by Git operations.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-32002, a vulnerability in Git that allows remote code execution (RCE) during a 'git clone' operation on case-insensitive filesystems (Windows and MacOS). The exploit leverages Git submodules with specially crafted paths and symlinks to inject a malicious hook into the .git directory of the cloned repository. The main exploit logic is contained in 'create_poc.sh', which sets up a malicious submodule containing a 'post-checkout' hook. This hook, when triggered during a recursive clone, executes arbitrary commands (demonstrated by launching the system calculator and writing a file to /tmp/pwnd). The repository structure includes a .gitmodules file specifying the submodule, a minimal file 'a' (containing '.git'), and the exploit creation script. The exploit targets users who clone the repository recursively on vulnerable systems, resulting in code execution. No network endpoints are involved; the attack is local to the filesystem and Git operations.

This repository demonstrates a proof-of-concept (PoC) exploit for CVE-2024-32002, a vulnerability in Git that allows for arbitrary code execution via malicious hooks and symbolic links. The main exploit script, PoC.sh, automates the process of creating two attacker-controlled Git repositories. The first repository (repo1) is prepared with a malicious post-checkout hook containing attacker-supplied payload code. The second repository (repo2) is configured to include repo1 as a submodule and to create a symbolic link to the .git directory, exploiting the vulnerability. The script then clones repo2, which triggers the malicious hook and executes arbitrary shell commands on the victim's machine. The exploit relies on the victim cloning a repository from an attacker-controlled HTTP endpoint. The repository contains two files: PoC.sh (the exploit script) and README.md (documentation and references). The exploit is a PoC and requires the attacker to supply the actual payload in the post-checkout hook.

This repository is a proof-of-concept (PoC) exploit for CVE-2024-32002, a vulnerability in Git. It contains two files: a README.md describing the exploit and a Bash script (git-poc.sh) that automates the exploitation process. The script sets up two Git repositories ('hook' and 'captain'), configures global Git settings to allow the file protocol and symlinks, and crafts a malicious post-checkout hook in the 'hook' repository. This hook, when triggered, executes 'open -a Calculator.app' (launching Calculator on macOS) and writes a marker file to /tmp/looooooooooooooooooool.txt, demonstrating arbitrary code execution. The script then adds the malicious repository as a submodule to the 'captain' repository, manipulates the .git directory via symlinks, and attempts a recursive clone to trigger the exploit. The PoC is intended for academic and defensive research purposes and demonstrates the risk of code execution via Git hooks in certain configurations. The main attack vector is local, requiring the victim to interact with a malicious repository under specific Git configurations.