Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2020-10977-read-and-execute — cve-2020-10977 read and execute | Kitploit
Tools/GitHubGitHub/lisp3r/cve-2020-10977-read-and-execute
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHublisp3r/cve-2020-10977-read-and-execute

cve-2020-10977-read-and-execute

cve-2020-10977 read and execute

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
15 years agoNot yet reviewed
Share

CVE-2020-10977 read and execute

About CVE-2020-10977

  • HackerOne Report: https://hackerone.com/reports/827052
  • Exploit-DB: https://www.exploit-db.com/exploits/48431
  • How to reproduce excecution part manually: From reading to execution

About this repository

  • get_secret.py - main script. It uses thewhiteh4t's code to exploit cve-2020-10977 at the first time and hook a secret_key_base from given repository. Then it launch cookie_maker.sh to generate cookie with payload.

    root@kitploit:~
    Usege: python get_secret.py http://gitlab.vh foo gfhjkm123

  • cookie_maker.sh - lauchs docker and generates malicious cookie. Can be used standalone.

root@kitploit:~
Usage: cookie_maker.sh <secret_key_base> "echo /etc/passwd > /tmp/owned"

Dependencies

  • Docker

Submodules

  • cve-2020-10977 - submodule by thewhiteh4t

Creds

Based on thewhiteh4t's repository: https://github.com/thewhiteh4t/cve-2020-10977

Warning

It can should contain bugs. If get_secret.py ended up correctly but no cookies it output - run it again.

Download Tool