Don't run web services as root. Use net capabilities if you need tcp port bindings below 1024. I'd also recommend running the git commands inside a forked pro

Don't run web services as root. Use net capabilities if you need tcp port bindings below 1024. I'd also recommend running the git commands inside a forked process with another user in the same group (which has limited access to the filesystem). Alternatively use the git user/group and add the web service daemon user to the git group. Also check that your linux distribution doesn't have binaries with the sticky flag set which could be used for privilege escalation. Double-check the list of gtfobins against your system's installed packages/binaries. [1] https://gtfobins.github.com https://gtfobins.github.com