Daniil Gordeev
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
ExploitDBRealtek rtl819x - Local Privilege
ExploitDB exploitPublished 2026-05-27ExploitCVE-2026-363551 file
Analysis
Technical assessment
A local privilege escalation exploit for the Realtek rtl819x Wi-Fi driver. It uses unrestricted ioctl handlers (0x89F5/0x89F6) to gain arbitrary kernel read/write, locates the current task_struct, and overwrites its credentials to gain root.
Backdoor review
No backdoor observed in reviewed code
The supplied C source code is a local privilege escalation exploit for CVE-2026-36355. It uses ioctl 0x89F5/0x89F6 to read and write kernel memory, locates the current task_struct, and overwrites credential fields to gain root. All behavior is consistent with the stated exploit purpose; no concealed payload, persistence mechanism, credential exfiltration, or unrelated remote access is present.
Classification basis and observed behavior
Classification basis
The code actively exploits a vulnerability to escalate privileges. It uses kernel read/write primitives to locate and modify the current process's credentials, then spawns a root shell. This is a full exploit, not just a scanner or writeup.
exploits/linux/local/52580.c:10exploits/linux/local/52580.c:405-419Requirements
- Unprivileged local user access on a system with a vulnerable Realtek rtl819x Wi-Fi driver loaded.
exploits/linux/local/52580.c:15 - A network interface using the vulnerable driver must be present.
exploits/linux/local/52580.c:99-118
Observed behavior
- Opens a UDP socket and uses it to send ioctl commands to a network interface.
exploits/linux/local/52580.c:340exploits/linux/local/52580.c:61 - Scans kernel memory for the init_task structure by searching for the string "swapper".
exploits/linux/local/52580.c:139-177 - Auto-detects task_struct field offsets (tasks, pid, cred, comm) from the init_task memory dump.
exploits/linux/local/52580.c:188-277 - Walks the kernel task list to find the task_struct of the current process.
exploits/linux/local/52580.c:281-325 - Overwrites the process's kernel credentials (UID, GID, capabilities) to gain root privileges.
exploits/linux/local/52580.c:407-408 - Executes /bin/sh to provide an interactive root shell.
exploits/linux/local/52580.c:419
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented vulnerability mechanism for CVE-2026-36355.
exploits/linux/local/52580.c:35-36exploits/linux/local/52580.c:48-95 - Exploit Behavior
- Payload withheldStandard kernel exploitation technique to find and modify the target process's credentials.
exploits/linux/local/52580.c:122-277exploits/linux/local/52580.c:281-325 - Exploit Behavior
- Payload withheldThis is the privilege escalation payload, directly matching the exploit's stated goal.
exploits/linux/local/52580.c:405-408 - Exploit Behavior
- Payload withheldStandard post-exploitation action to provide an interactive root shell.
exploits/linux/local/52580.c:419
What the analysis did not establish
- Only the supplied C source file was reviewed; no binary or runtime analysis was performed.
- The exploit's behavior depends on the vulnerable kernel driver; the review does not assess whether the exploit is functional or safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
ExploitDBMeiG Smart FORGE_SLT711 - OS Command Injection
ExploitDB exploitPublished 2026-05-27ExploitCVE-2026-363561 file
Analysis
Technical assessment
Python script that sends a crafted HTTP POST request to the /action/SetRemoteAccessCfg endpoint of a MeiG Smart FORGE_SLT711 device to achieve unauthenticated remote command execution as root via OS command injection in the password field.
Backdoor review
No backdoor observed in reviewed code
The provided Python script is a straightforward proof-of-concept exploit for CVE-2026-36356. It sends a user-supplied command via a JSON payload to a vulnerable endpoint on a target device. The script contains no hidden or deceptive functionality, no persistence mechanisms, no data exfiltration to unrelated parties, and no obfuscated payloads. All actions are directly related to the described OS command injection vulnerability.
Classification basis and observed behavior
Classification basis
The script actively sends a malicious payload to a vulnerable endpoint to execute arbitrary OS commands on the target, which constitutes exploitation rather than mere detection or analysis.
exploits/linux/hardware/52581.py:28-54Requirements
- Target must be a MeiG Smart FORGE_SLT711 device with vulnerable GoAhead web server accessible over the network.
exploits/linux/hardware/52581.py:1
Observed behavior
- Sends a POST request to /action/SetRemoteAccessCfg with a JSON body containing a password field with a command injection payload.
exploits/linux/hardware/52581.py:29-37 - Injects an arbitrary OS command via the password field using command substitution syntax $(cmd).
exploits/linux/hardware/52581.py:30 - Checks HTTP response for retcode 0 to confirm command execution.
exploits/linux/hardware/52581.py:43-44
Behaviors behind the backdoor verdict
Observables
- Command Injection Payload
- Payload withheldThe script constructs a JSON payload where the user-provided command is embedded within a shell command substitution, which is the core of the documented exploit.
exploits/linux/hardware/52581.py:30 - Network Request
- Payload withheldThe script sends the malicious payload to the vulnerable endpoint on the target device, consistent with the CVE description.
exploits/linux/hardware/52581.py:29
What the analysis did not establish
- Review is limited to the single provided Python file; no external libraries, dependencies, or referenced resources were analyzed.
- The script's behavior depends on the user-supplied '--cmd' argument; the review does not assess the safety of any command a user might choose to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.