1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
# Caplet for exploiting CVE-2018-11235
This caplet is intercepting http/https git clone attempts and
redirecting them to local http server that serves a malicious
repository leading to exploitation of CVE-2018-11235 on vulnerable
client.
## How to use
1. Create a malicious repository with `build_repo.sh` script. The
script will take the contents of `payload.txt` as payload -
customize the payload file to your needs.
2. Run the caplet with:
```
bettercap -caplet caplets/gitspoof/gitspoof.cap
```
## Alternative use cases
You can control to which repository redirect the victim, by changing
`gitspoof.repo` variable to an IP or domain (do not prefix with
http(s)). This way if the victim is not susceptible to CVE-2018-11235
you can still try to inject arbitrary code into the repo - this might
come in handy when trying to exploit some bad CI/deployment scripts.
## Limitations
Obviously the script won't be able to intercept https git clones
unless you can obtain a valid SSL cert or the victim used `-c
http.sslVerify=false` configuration option.
The script was aimed at attacking automated systems not people
therefore the repo layout doesn't try hard to look inconspicuous ;)
Attacking human with this caplet would require to also spoof some
trusted domain and point it at bettercap server since Git will always
notify the user about http redirect.
Finally - all the CVE-2018-11235 limitations apply - to get RCE the
victim needs to have vulnerable git client **and** do a recursive
git clone (or initialize the submodules afterwards).
## POC testing
You can test the script yourself without arp poison:
1. Setup vulnerable git on your system
2. Fire the caplet (remember to run `./build_repo.sh` first!)
3. On vulnerable system run:
```
http_proxy=<ip address of bettercap machine><bettercap_http_port> git clone --recursive http://github.com/bettercap/bettercap /tmp/exploit
```
(**NOTE**: we are intentionally trying to clone via http on github)
The clone should trigger the default payload.
|
