Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-21300 — Demonstrates CVE-2021-21300 arbitrary code execution via malicious Git hooks on case-insensitive filesystems, including exploit steps and defensive measures. | Kitploit
Tools/GitHubGitHub/sizvy/cve-2021-21300
Vulnerability AnalysisExploitationWeb Application ExploitationPapers & ResearchLearning & EducationBinary Exploitation
GitHubsizvy/cve-2021-21300

CVE-2021-21300

Demonstrates CVE-2021-21300 arbitrary code execution via malicious Git hooks on case-insensitive filesystems, including exploit steps and defensive measures.

View Repository
111 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-21300: Arbitrary Code Execution via Malicious Git Hooks

📌 Summary

CVE-2021-21300 is a critical vulnerability in Git (versions 2.14.2 to 2.30.1) that allows attackers to execute arbitrary code on victim machines by exploiting symbolic links and case-insensitive file systems.

🧠 Problem Statement

  • Vulnerability: Arbitrary code execution via malicious Git hooks.
  • Root Cause: Case-insensitive filesystems (e.g., Windows/macOS) resolve A/post-checkout as .git/hooks/post-checkout.
  • Impact: Attackers can inject and execute malicious hooks when a user clones the infected repository.

🔍 Theoretical Background

The Trick

Git allows user-defined hooks stored in .git/hooks/. On case-insensitive file systems:

  • A crafted folder like A/post-checkout may be interpreted as .git/hooks/post-checkout.
  • A symbolic link replaces A/ with .git/hooks/, bypassing restrictions.

The Exploit

  1. Create directory A and a file A/post-checkout containing malicious commands.
  2. Stage the directory and its contents for Git.
  3. Remove the directory and replace A with a symlink to .git/hooks/.
  4. When Git executes A/post-checkout, it actually runs the malicious file in .git/hooks/.

⚠️ Trigger Conditions

  • Case-insensitive filesystem (Windows/macOS).
  • Symbolic link to .git/hooks/.
  • Global Git LFS filters enabled.
  • Victim has permission to execute malicious code.

🛠️ Attack Workflow

Malicious Repo Generation

  • Create .gitattributes to trigger LFS processing of A/post-checkout.
  • Add a malicious script A/post-checkout (e.g., prints "PWNED").
  • Add fake files A/a, A/b to make it look legitimate.
  • Replace A/ with symlink to .git/hooks/.
  • Commit and push the changes.

🛡 Existing Defenses

Configuration-Based

  • Disable symbolic link following:
    root@kitploit:~
    git clone -c core.symlinks=true
git config --system core.symlinks true

##💡 Other Potential Defenses

  • Automate Safe Cloning with Git Alias

  • Make directory.

  • Enable case sensitivity (Windows):

    root@kitploit:~
    fsutil file setcasesensitiveinfo <DESTINATION FOLDER> enable

  • Clone into that directory.

  • Create a Git alias to automate these steps for safer cloning.

Download Tool