Privilege misuse in OpenShift build git-clone container leading to node command execution

Repository contains only three files: .gitattributes, a minimal Dockerfile, and a readme.md that provides the actual exploit steps and payload. The core technique is a supply-chain/CI attack: .gitattributes assigns the Dockerfile to a custom git filter (filter=dockerfile). The attacker then supplies a malicious .gitconfig (injected into an OpenShift build via sourceSecret) defining filter.dockerfile.smudge as a long shell command. When the build system performs a git checkout, Git applies the smudge filter to the Dockerfile, executing attacker-controlled commands. The smudge payload attempts a host escape by mounting /dev/vda4 to /mnt/h and writing into Fedora CoreOS ostree deployment paths. It drops a base64-decoded bash agent (agent.sh) and establishes persistence by replacing /usr/local/bin/kubenswrapper on the host with a wrapper that starts the agent in the background and then executes the original binary (renamed to kubenswrapper.real). The agent implements a simple command channel: it repeatedly finds a running docker-build container via crictl, derives a host path under /var/lib/kubelet/pods/.../buildworkdir, scans input files for a 'helloworld:' prefix, evals the remainder as a shell command, and writes the output to OUTPUT.txt for retrieval in subsequent builds/logs (the Dockerfile cats /OUTPUT.txt). Overall purpose: demonstrate CVE-2024-45496 exploitation in an OpenShift build context by turning git checkout into code execution, then pivoting to node persistence and command execution via build artifacts.