Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2020-8816 — A PoC for CVE-2020-8816 that does not use $PATH but $PWD and globbing | Kitploit
Tools/GitHubGitHub/martinsohn/cve-2020-8816
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlRed Teaming
GitHubmartinsohn/cve-2020-8816

CVE-2020-8816

A PoC for CVE-2020-8816 that does not use $PATH but $PWD and globbing

View Repository
114 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Notes to defend against this exploit

  • Patching
    • Just do it... now.
    • Subscribe to/watch the Pi-hole repository for new releases (and Issues and Pull requests if you're serious).
  • Network
    • Do not expose Pi-hole to the internet.
    • Only expose Pi-hole DNS port 53 to DNS clients, not other ports like management interface.
  • Management
    • Use unique and complex (meaning many characters) passphrases for admin account.

CVE-2020-8816

The full PoC is available in the PDF document

This is a variation of a PoC for RCE on Pi-hole 4.3.2: https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/

The original PoC requires the $PATH variable to be 'opt/pihole:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'. This is not the case for a Pi-hole installation on Ubuntu Server with default settings.

Therefore, my PoC requires the $PWD variable for www-data to be '/var/www/html/admin'. This should be the case for more types of Pi-hole installations. My PoC also solves a problem: this new string from $PWD does not contain the letter ‘p’ required for a ‘php -r' execution as used in the original PoC.

Download Tool