16.-Attacking-gitlab
1. Username Enumeration
Manual Enumeration
Attempt to register accounts with various usernames. GitLab will indicate if a username is already taken, confirming its existence.
Automated Enumeration
Use the
gitlab_userenum.shscript or its Python3 equivalent to automate the process.
Command Examples
Password Spraying
After enumerating usernames, perform password spraying with common passwords or credentials from data breaches.
GitLab’s default account lockout policy:
10 failed attempts trigger a 10-minute lockout.
Avoid brute-force detection by using slow, distributed attacks.
2. Authenticated Remote Code Execution (RCE)
Vulnerability Details
GitLab Community Edition ≤13.10.2 is vulnerable to RCE due to improper handling of ExifTool metadata.
Exploitation Steps
Use the
gitlab_13_10_2_rce.pyexploit script.Execute the following command to gain a reverse shell:
Command Example
Setting Up a Netcat Listener
Start a Netcat listener to receive the reverse shell connection.
Command Example
Key Takeaways
Username Enumeration
Helps identify valid accounts for potential password spraying.
GitLab’s lockout settings must be factored into attack methodology.
RCE Exploitation
The ExifTool vulnerability allows remote code execution with valid credentials.
If self-registration is enabled, attackers can create an account for exploitation.
Reverse Shell Considerations
The RCE exploit initiates a reverse shell to establish persistent access.
Ethical Considerations
Only conduct testing on authorized systems.
Replace placeholders (IP addresses, ports, credentials) with real values as needed.
Summary of Commands
Last updated