ashutosh0408/cve-2024-32002-poc
This repository contains a PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on case-insensitive filesystems to write files into the .git/ directory, leading to the execution of malicious hooks.
This repository contains a Proof of Concept (PoC) for CVE-2024-32002, a Remote Code Execution (RCE) vulnerability in Git submodules. The exploit demonstrates how a malicious payload can be triggered via a recursive clone of a Git repository.
Before running the PoC, create the following repositories on your remote Git server or feel free to change the names as needed:
hulk.gitsubmod.gitsmash.gitUpdate the repository paths in the PoC script accordingly if you change the names.
The exploit leverages Git submodules to execute a payload on the target system when the repository is cloned recursively. This PoC is tested on macOS.
HULK_REPO="[email protected]:safebuffer/hulk.git"
pullme_REPO="[email protected]:safebuffer/submod.git"
# Final Exploit Repo
SMASH_REPO="[email protected]:safebuffer/smash.git"
To trigger the exploit, run the poc.sh script and then execute the following command:
git clone --recursive $SMASH_REPO
The default payload in this PoC opens the Calculator application on macOS. You can change this to any payload of your choice.
/System/Applications/Calculator.app/Contents/MacOS/Calculator
This PoC is for educational purposes only. Use it responsibly and only on systems where you have explicit permission to test. Misuse of this PoC can result in severe consequences.