gitingest LFS-primer bootstrap (public for anon ingest)
| Filename | Latest commit message | Latest commit date |
|---|---|---|
| .gitattributes | ||
| lfs_object.dat | ||
| lfs_object_content.bin | ||
| README.md | ||
| shim_git-lfs | ||
gitingest-pwn PRIMER (ingest #1)
Purpose: prove that a command executes as gitingest's service user at
checkout time, and plant the filter.pwnsmudge definition into that service
user's global gitconfig, so the second (RCE) ingest can rely on it.
Mechanism: rides the pre-existing filter.lfs (assumed present — git-lfs is
near-universal). .gitattributes assigns filter=lfs to lfs_object.dat (an LFS
pointer) and shim_git-lfs. At checkout, git-lfs smudge runs in the service
context; the shim (once at the head of PATH) also appends the [pwnsmudge] block
into ~/.gitconfig.
Assumptions / tweak points:
- git-lfs installed on gitingest's host (
filter.lfsresolvable). If not, swap the primer to ride whichever pre-existing filter their config has (inspect the live global gitconfig — env-verification step you chose to defer). smudge = ... 'echo __PWNSMUDGE_FIRED__; cat'is a probe — it just marks success. For the real RCE, this is where the full smudge (authorized_keys + env dump + MAIN_MARKER + setup_done.flag) belongs; it's carried by the RCE ingest (#2).