The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Python scripts designed to execute commands on remote GitLab instances by exploiting CVE-2021-22205.
The exploit payload is delivered via a specially crafted DjVu file uploaded to the /uploads/user endpoint.
It utilizes Perl's qx{} operator within DjVu metadata to trigger command execution upon processing by ExifTool.
[DATA_EXFILTRATION]: Contains instructions and scripts to read sensitive system files from remote targets via path traversal (CVE-2023-2825).
The implementation demonstrates constructing URLs with multiple %2f.. sequences to access /etc/passwd on vulnerable GitLab versions (16.0.0).
[REMOTE_CODE_EXECUTION]: Facilitates unauthenticated remote code execution on targets by leveraging flaws in image processing (ExifTool).
Includes a standalone exploit script references/cve-rce-exploits.md that generates the malicious multipart/form-data payload.
[EXTERNAL_DOWNLOADS]: The provided Python scripts use the requests and urllib3 libraries to perform network operations against arbitrary target URLs provided by the user.
These operations are used for vulnerability scanning, information gathering (fetching /help or /api/v4/projects), and delivering exploit payloads.

gitlab-exploit