webProhard

Where's Your HEAD At?

kalmarctf

Task: a Flask service cloned an attacker-controlled Git repository, created `headlocation`, then executed `git show HEAD` from inside that path. Solution: hide a bare repository at `headlocation`, force a promisor fetch for a missing object, and use repo-local `sshCommand` to run `/flagout` and exfiltrate the flag.

$ ls tags/ techniques/
gitcommand_executionsuidgit_clonebare_repositorypartial_clonepromisor_remotesshcommand
buried_bare_repo_confusionpromisor_fetch_triggersshcommand_rceout_of_band_exfiltration
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups