Skip to content

Commit

Permalink
remove GIT_HOOK option
Browse files Browse the repository at this point in the history
post-checkout is the only hook that will work
with this exploit, so no option is needed. Also update
the documentation to reflect that.
  • Loading branch information
space-r7 committed Aug 12, 2021
1 parent 31cbcb7 commit c9bdd96
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 7 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,6 @@ Versions of Git below those in the following list are vulnerable:

Sets the Git repository path. Leave empty for randomly-generated path.

### GIT_HOOK

Sets the Git hook script to be written. `post-checkout` is the default.

## Scenarios

### Git `v2.20.1` on MacOS 10.14.6
Expand Down
5 changes: 2 additions & 3 deletions modules/exploits/multi/http/git_lfs_clone_command_exec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,7 @@ def initialize(info = {})

register_options(
[
OptString.new('GIT_URI', [ false, 'The URI to use as the malicious Git instance (empty for random)', '' ]),
OptString.new('GIT_HOOK', [ false, 'The Git hook to use to trigger the payload', 'post-checkout' ])
OptString.new('GIT_URI', [ false, 'The URI to use as the malicious Git instance (empty for random)', '' ])
]
)

Expand All @@ -88,7 +87,7 @@ def setup_repo_structure
dir_name = link_name.upcase
git_attr = '.gitattributes'

git_hook = datastore['GIT_HOOK']
git_hook = 'post-checkout'
@hook_payload = "#!/bin/sh\n#{payload.encoded}"
ptr_file = generate_pointer_file(@hook_payload)

Expand Down

0 comments on commit c9bdd96

Please sign in to comment.