miscProhard

Git Hoarder

kalmarctf

Task: Service runs git clone on user-provided URL, goal is RCE to read /app/flag.txt. Solution: Chain 3 clones - create symlink to HOME, write .gitconfig via symlink to enable ext:: protocol, then RCE via ext::sh command.

$ ls tags/ techniques/
multi_stagercegitsymlinksubprocessurl_parsinggit_clonegitconfigext_protocol
git_url_destination_parsingsymlink_clone_redirectgitconfig_protocol_injectionext_protocol_rcechained_clone_attack
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups