webhard

Where's Your HEAD At?

kalmarctf

Task: a Flask service cloned an attacker-controlled Git repository, created `headlocation`, then executed `git show HEAD` from inside that path. Solution: hide a bare repository at `headlocation`, force a promisor fetch for a missing object, and use repo-local `sshCommand` to run `/flagout` and exfiltrate the flag.

$ ls tags/ techniques/
gitcommand_executionsuidgit_clonebare_repositorypartial_clonepromisor_remotesshcommand
buried_bare_repo_confusionpromisor_fetch_triggersshcommand_rceout_of_band_exfiltration
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]