CTF-Writeups

Gigs writeup

Summary

The instance runs Gogs with the default “first user is admin” behavior. Admins can edit custom Git hooks from the web UI. Because the container exposes /data/gogs/public as the custom public static directory, a post-receive hook can copy the flag from /data/gogs/data/flag.txt to /data/gogs/public/flag.txt, which is then reachable at /flag.txt.

Recon

• gigs/Dockerfile copies flag.txt to /data/gogs/data/flag.txt.
• gigs/Dockerfile sets GOGS_CUSTOM=/data/gogs.
• gogs/docker/s6/gogs/setup symlinks /app/gogs/data -> /data/gogs/data.
• internal/cmd/web.go serves static files from ${GOGS_CUSTOM}/public.

Exploit

1) Register and log in (first user becomes admin). 2) Create a repo. 3) Open Git hooks editor: /<user>/<repo>/settings/hooks/git/post-receive. 4) Set the hook content:

#!/bin/sh
mkdir -p /data/gogs/public
cat /data/gogs/data/flag.txt > /data/gogs/public/flag.txt

5) Push any commit to trigger the hook. 6) Fetch the flag: http://z6gdv1u5.chals.mctf.io/flag.txt.

Flag

MetaCTF{g1t_l0v3s_5ymlink5}