1

I'm pen-testing an application with a bug bounty program.

I've found a .git folder which just gives a 403 forbidden error.

However, when browsing to directories such as dodgy.com/.git/config, the file will download.

I discovered this a few hours ago and figured I would try to create a bash script which 'blindly' downloads a git repo.

Obviously I can just report the current findings, however it would be great to see how much information I can pull.

So far this script:

  1. Downloads all standard files known to git (for example, /refs/heads/master)
  2. Uses cat /refs/heads/master to find the head commit
  3. Downloads the head commit by generating the relevant object directory structure
    • For example, if a commit is 4b5a29b99bcb8b007c2f3932c9a49662aab1505e, the object will be saved at /objects/4b/5a29b99bcb8b007c2f3932c9a49662aab1505e.
    • This allows
      1. finding the object file blindly,
      2. generating the correct local directory structure.
  4. For each commit found, downloads the next commit by parsing errors shown by git log

Steps 3 and 4 are repeated to download trees, which can be found by running git show xyz, and parsing the error message generated...

The only thing missing (as far as I know from limited research) is downloading a .pack file.

Git stores most of its history in a file at /objects/pack/pack-{sha1}.pack.

From my research, I cannot see how to generate the sha1 without full access to a git repo.

Is it possible to generate a .pack file name from an incomplete number of commit and tree object files?

The more I read the more I feel impossible. Relevant info here.

Improve this question
1

2 Answers 2

Reset to default
1

A first step would be to simply try to git clone the URL ending in .git. Depending on the remote repository's configuration, the git client may be able to create a copy on its own!

If not, you may be able to obtain a list of packs at the relative URL:

.git/objects/info/packs

If the remote repository contains packs, they will be listed in the format:

P pack-c3499c2729730a7f807efb8676a92dcb6f8a3f8f.pack

which will indicate that a pack exists at:

.git/objects/pack/c3499c2729730a7f807efb8676a92dcb6f8a3f8f.pack

Two other paths worth investigating are:

  • .git/config -- this may contain sensitive configuration information, such as the URL and username that were used to clone the repository
  • .git/info/refs -- may contain names of branches or tags that you weren't otherwise aware of
Improve this answer
3
  • All relevant info however my question involves downloading without a directory listing ie. browsing to dodgy.com/.git/objects/info/packs gives a 403 error. This involves 'finding' commits and trees by parsing error messages caused by an incomplete git log. The last step, which I'm aware of, is to somehow find the name of pack files - without directory access.
    – 0lly
    May 1, 2017 at 23:08
  • @fsociety objects/info/packs is a file, not a directory. Unless the operator of the site has taken some special steps to protect that file, it should be readable.
    – user82155
    May 1, 2017 at 23:53
  • Sorry you are right - misread that path - though all the git repos I have tested don't have this file...
    – 0lly
    May 2, 2017 at 0:57
0

Try using GitTools. It is specifically meant for your situation. It can download an exposed .git directory even if directory listing is disabled.

Improve this answer
1
  • That seems to do what I wrote, and doesn't find the .pack files... Thanks though. Note: This tool has no 100% guaranty to completely recover the .git repository. Especially if the repository has been compressed into pack-files, it may fail.
    – 0lly
    May 1, 2017 at 10:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .