HTTP Git Scanner - Metasploit

This page contains detailed information about how to use the auxiliary/scanner/http/git_scanner metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

Name: HTTP Git Scanner
Module: auxiliary/scanner/http/git_scanner
Source code: modules/auxiliary/scanner/http/git_scanner.rb
Disclosure date: -
Last modification time: 2017-07-24 06:26:21 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 8000, 8008, 8080, 8443, 8880, 8888
List of CVEs: -

This module can detect situations where there may be information disclosure vulnerabilities that occur when a Git repository is made available over HTTP.

Module Ranking and Traits

Module Ranking:

normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/scanner/http/git_scanner
msf auxiliary(git_scanner) > show options
    ... show and set options ...
msf auxiliary(git_scanner) > set RHOSTS ip-range
msf auxiliary(git_scanner) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(git_scanner) > set RHOSTS 192.168.1.3-192.168.1.200

Example 2:

msf auxiliary(git_scanner) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(git_scanner) > set RHOSTS file:/tmp/ip_list.txt

Required Options

RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Knowledge Base

Vulnerable Application

This module looks for a .git folder on a web server, and attempts to read the config and index files to gather information about the repo.

Environment

On Kali, we can clone metasploit into the apache folder to create a vulnerable environment.

root@kali:~# cd /var/www/html/
root@kali:/var/www/html# git clone https://github.com/rapid7/metasploit-framework.git
Cloning into 'metasploit-framework'...
remote: Enumerating objects: 49, done.
remote: Counting objects: 100% (49/49), done.
remote: Compressing objects: 100% (41/41), done.
remote: Total 509870 (delta 18), reused 20 (delta 8), pack-reused 509821
Receiving objects: 100% (509870/509870), 415.71 MiB | 8.61 MiB/s, done.
Resolving deltas: 100% (372897/372897), done.
Updating files: 100% (10064/10064), done.
root@kali:/var/www/html# service apache2 start

Verification Steps

Install a git repo in a web server
Start msfconsole
Do: use auxiliary/scanner/http/git_scanner
Do: set rhosts [ip]
Do: run
You should get information about the git repo

Options

GIT_CONFIG

Attempts to locate the config file, which may contain useful information. Default is true.

GIT_INDEX

Attempts to locate the index file, which identifies the git version and number of files. Default is true.

TARGETURI

Where the .git folder is located. Default is /.git/

UserAgent

The user agent to emulate. Default is git/1.7.9.5.

Scenarios

Metasploit git on Kali

msf5 > use auxiliary/scanner/http/git_scanner 
msf5 auxiliary(scanner/http/git_scanner) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf5 auxiliary(scanner/http/git_scanner) > set TARGETURI /metasploit-framework/.git/
TARGETURI => /metasploit-framework/.git/
msf5 auxiliary(scanner/http/git_scanner) > run

[+] http://127.0.0.1/metasploit-framework/.git/ - git repo (version 2) found with 10064 files
[+] http://127.0.0.1/metasploit-framework/.git/config - git config file found
[+] Saved file to: /root/.msf4/loot/20191007202314_default_127.0.0.1_config_236738.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Go back to menu.

Msfconsole Usage

Here is how the scanner/http/git_scanner auxiliary module looks in the msfconsole:

msf6 > use auxiliary/scanner/http/git_scanner

msf6 auxiliary(scanner/http/git_scanner) > show info

       Name: HTTP Git Scanner
     Module: auxiliary/scanner/http/git_scanner
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Nixawk
  Jon Hart <[email protected]>

Check supported:
  No

Basic options:
  Name        Current Setting  Required  Description
  ----        ---------------  --------  -----------
  GIT_CONFIG  true             yes       Check config file in .git directory
  GIT_INDEX   true             yes       Check index file in .git directory
  Proxies                      no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT       80               yes       The target port (TCP)
  SSL         false            no        Negotiate SSL/TLS for outgoing connections
  TARGETURI   /.git/           yes       The test path to .git directory
  THREADS     1                yes       The number of concurrent threads (max one per host)
  UserAgent   git/1.7.9.5      yes       The HTTP User-Agent sent in the request
  VHOST                        no        HTTP server virtual host

Description:
  This module can detect situations where there may be information 
  disclosure vulnerabilities that occur when a Git repository is made 
  available over HTTP.

References:
  https://github.com/git/git/blob/master/Documentation/technical/index-format.txt

Module Options

This is a complete list of options available in the scanner/http/git_scanner auxiliary module:

msf6 auxiliary(scanner/http/git_scanner) > show options

Module options (auxiliary/scanner/http/git_scanner):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   GIT_CONFIG  true             yes       Check config file in .git directory
   GIT_INDEX   true             yes       Check index file in .git directory
   Proxies                      no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT       80               yes       The target port (TCP)
   SSL         false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI   /.git/           yes       The test path to .git directory
   THREADS     1                yes       The number of concurrent threads (max one per host)
   UserAgent   git/1.7.9.5      yes       The HTTP User-Agent sent in the request
   VHOST                        no        HTTP server virtual host

Advanced Options

Here is a complete list of advanced options supported by the scanner/http/git_scanner auxiliary module:

msf6 auxiliary(scanner/http/git_scanner) > show advanced

Module advanced options (auxiliary/scanner/http/git_scanner):

   Name                  Current Setting  Required  Description
   ----                  ---------------  --------  -----------
   DOMAIN                WORKSTATION      yes       The domain to use for Windows authentication
   DigestAuthIIS         true             no        Conform to IIS, should work for most servers. Only set to false for non-IIS servers
   FingerprintCheck      true             no        Conduct a pre-exploit fingerprint verification
   HttpClientTimeout                      no        HTTP connection and receive timeout
   HttpPassword                           no        The HTTP password to specify for authentication
   HttpRawHeaders                         no        Path to ERB-templatized raw headers to append to existing headers
   HttpTrace             false            no        Show the raw HTTP requests and responses
   HttpTraceColors       red/blu          no        HTTP request and response colors for HttpTrace (unset to disable)
   HttpTraceHeadersOnly  false            no        Show HTTP headers only in HttpTrace
   HttpUsername                           no        The HTTP username to specify for authentication
   SSLVersion            Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress          true             yes       Display progress messages during a scan
   ShowProgressPercent   10               yes       The interval in percent that progress should be shown
   VERBOSE               false            no        Enable detailed status messages
   WORKSPACE                              no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the scanner/http/git_scanner module can do:

msf6 auxiliary(scanner/http/git_scanner) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the scanner/http/git_scanner auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(scanner/http/git_scanner) > show evasion

Module evasion options:

   Name                          Current Setting  Required  Description
   ----                          ---------------  --------  -----------
   HTTP::header_folding          false            no        Enable folding of HTTP headers
   HTTP::method_random_case      false            no        Use random casing for the HTTP method
   HTTP::method_random_invalid   false            no        Use a random invalid, HTTP method for request
   HTTP::method_random_valid     false            no        Use a random, but valid, HTTP method for request
   HTTP::pad_fake_headers        false            no        Insert random, fake headers into the HTTP request
   HTTP::pad_fake_headers_count  0                no        How many fake headers to insert into the HTTP request
   HTTP::pad_get_params          false            no        Insert random, fake query string variables into the request
   HTTP::pad_get_params_count    16               no        How many fake query string variables to insert into the request
   HTTP::pad_method_uri_count    1                no        How many whitespace characters to use between the method and uri
   HTTP::pad_method_uri_type     space            no        What type of whitespace to use between the method and uri (Accepted: space, tab, apache)
   HTTP::pad_post_params         false            no        Insert random, fake post variables into the request
   HTTP::pad_post_params_count   16               no        How many fake post variables to insert into the request
   HTTP::pad_uri_version_count   1                no        How many whitespace characters to use between the uri and version
   HTTP::pad_uri_version_type    space            no        What type of whitespace to use between the uri and version (Accepted: space, tab, apache)
   HTTP::uri_dir_fake_relative   false            no        Insert fake relative directories into the uri
   HTTP::uri_dir_self_reference  false            no        Insert self-referential directories into the uri
   HTTP::uri_encode_mode         hex-normal       no        Enable URI encoding (Accepted: none, hex-normal, hex-noslashes, hex-random, hex-all, u-normal, u-all, u-random)
   HTTP::uri_fake_end            false            no        Add a fake end of URI (eg: /%20HTTP/1.0/../../)
   HTTP::uri_fake_params_start   false            no        Add a fake start of params to the URI (eg: /%3fa=b/../)
   HTTP::uri_full_url            false            no        Use the full URL for all HTTP requests
   HTTP::uri_use_backslashes     false            no        Use back slashes instead of forward slashes in the uri
   HTTP::version_random_invalid  false            no        Use a random invalid, HTTP version for request
   HTTP::version_random_valid    false            no        Use a random, but valid, HTTP version for request

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

<INDEX_URI> - No response received
<CONFIG_URI> - No response received

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

<INDEX_URI> - No response received

Here is a relevant code snippet related to the "<INDEX_URI> - No response received" error message:

56:	
57:	  def git_index
58:	    res = req('index')
59:	    index_uri = git_uri('index')
60:	    unless res
61:	      vprint_error("#{index_uri} - No response received")
62:	      return
63:	    end
64:	    vprint_status("#{index_uri} - HTTP/#{res.proto} #{res.code} #{res.message}")
65:	
66:	    return unless res.code == 200

<CONFIG_URI> - No response received

Here is a relevant code snippet related to the "<CONFIG_URI> - No response received" error message:

79:	
80:	  def git_config
81:	    res = req('config')
82:	    config_uri = git_uri('config')
83:	    unless res
84:	      vprint_error("#{config_uri} - No response received")
85:	      return
86:	    end
87:	    vprint_status("#{config_uri} - HTTP/#{res.proto} #{res.code} #{res.message}")
88:	
89:	    return unless res.code == 200 && res.body =~ /\[(?:branch|core|remote)\]/

Go back to menu.

References

Authors

Nixawk
Jon Hart <jon_hart[at]rapid7.com>

Version

This page has been produced using Metasploit Framework version 6.2.29-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.

HTTP Git Scanner - Metasploit

Module Overview

Module Ranking and Traits

Basic Usage

Required Options

Knowledge Base

Vulnerable Application

Environment

Verification Steps

Options

Scenarios

Metasploit git on Kali

Msfconsole Usage

Module Options

Advanced Options

Auxiliary Actions

Evasion Options

Error Messages

<INDEX_URI> - No response received

<CONFIG_URI> - No response received

References

See Also

Authors

Version

Nessus Plugin Library

Solving Problems with Office 365 Email from GoDaddy

Empire Module Library

CrackMapExec Module Library

Metasploit Android Modules

Top 16 Active Directory Vulnerabilities

Top 10 Vulnerabilities: Internal Infrastructure Pentest

Terminal Escape Injection

Cisco Password Cracking and Decrypting Guide

Capture Passwords using Wireshark

SSH Brute Force Attack Tool using PuTTY / Plink (ssh-putty-brute.ps1)

SMB Brute Force Attack Tool in PowerShell (SMBLogin.ps1)

Port Scanner in PowerShell (TCP/UDP)

Nessus CSV Parser and Extractor

Default Password Scanner (default-http-login-hunter.sh)

HTTP Git Scanner - Metasploit

Module Overview

Module Ranking and Traits

Basic Usage

Required Options

Knowledge Base

Vulnerable Application

Environment

Verification Steps

Options

Scenarios

Metasploit git on Kali

Msfconsole Usage

Module Options

Advanced Options

Auxiliary Actions

Evasion Options

Error Messages

<INDEX_URI> - No response received

<CONFIG_URI> - No response received

Related Pull Requests

References

See Also

Authors

Version