Abusing Trust Boundaries for RCE

Hey GusC​, I got a hint for you, that I hope helps:

To clone the repository, use the standard git clone <URL> command in your terminal using the link provided in the lab brief. The .mcp.json file doesn't pre-exist because you are crafting it as your payload; you'll typically need to create it in the root directory of your repo so the target application parses it upon loading. Once you commit and push this malicious configuration, the lab environment will simulate the target victim automatically interacting with your repository, which is what ultimately triggers the execution and drops your shell.