Mafia Takedown: The Digital Heist

by selfmade ✓ first-party

A flaw was found in the way git-shell handled command-line options for the restricted set of git-shell commands. A remote, authenticated attacker could use this flaw to bypass git-shell restrictions, to view and manipulate files, by abusing the instance of the less command launched using crafted command-line options. CVE 2017-8386.

challenge lab image ready

OSINT & Recon Network Privilege Escalation

git-shell Sandbox Bypass (CVE-2017-8386)

git-shell sandbox bypass (CVE-2017-8386) leads to arbitrary file reading, possibly arbitrary command execution vulnerabilities.

Reference link:

https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/ https://www.leavesongs.com/PENETRATION/git-shell-cve-2017-8386.html

Install

Open LabStore on any connected Selfmade Ninja Labs instance and press Get — or run this from the instance shell:

labsctl store-install git-cve-2017-8386

About

Kind: challenge lab
Publisher: selfmade
Version: bec19e3728be
Updated: 18 Sep 2026
Image: prebuilt — pulled at install

Source

View repository ↗

image git.selfmade.ninja:5050/academy/lab-templates/git-cve-2017-8386:lab

digest sha256:1c87b35bd1af035ca38…

Every store app is stripped of privileged/host-mount settings at install and runs contained on the installing host. The rules.