devianntsec
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubdevianntsec/CVE-2024-30051
Repository PoCStars: 1Created 2026-03-25ExploitCVE-2024-3005145 files
Analysis
Technical assessment
The artifact is a complete exploit for CVE-2024-30051, a heap-based buffer overflow in Windows DWM Core Library. It includes C++ source code that performs API hooking, heap spraying, and memory corruption to achieve local privilege escalation to SYSTEM integrity level.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2024-30051, a Windows DWM heap overflow elevation of privilege. The exploit code (main.cpp) performs heap spraying, API hooking, and memory corruption to load a payload DLL (dllmain.cpp) into the DWM process. The payload DLL spawns a SYSTEM-level command prompt and performs self-cleanup. All observed behavior is consistent with the stated exploit objective; no concealed backdoor, unrelated remote access, persistence mechanism, or credential theft was found in the reviewed source code.
Classification basis and observed behavior
Classification basis
The artifact contains complete C++ source code that actively exploits CVE-2024-30051 by hooking system APIs, corrupting heap memory, and injecting a payload to achieve code execution as SYSTEM. The README explicitly describes it as an exploit and provides step-by-step instructions for building and running it to gain elevated privileges.
README.md:9-10README.md:97-105exploit/exploit_src/main.cpp:1-1203Requirements
- Windows 11 22H2 build 22621.3447 without patch KB5037771
README.md:11README.md:77 - Visual Studio 2022 with C++ Desktop workload to build the exploit and payload DLL
README.md:78 - Payload DLL (s11.dll) must be placed at payload withheld before running the exploit
README.md:87-91
Observed behavior
- Installs inline hooks on RtlAllocateHeap, RtlCreateHeap, NtDCompositionCreateChannel, and NtDCompositionCommitChannel to intercept DWM heap operations and DirectComposition channel creation
exploit/exploit_src/main.cpp:411-480exploit/exploit_src/main.cpp:769-787 - Modifies the size field in a DWM heap chunk from 0x120 to 0x23F to trigger a 0x8F-byte heap overflow during memcpy
exploit/exploit_src/main.cpp:574-602 - Performs a heap spray of 0x10000 CHolographicInteropTexture objects and frees holes to control heap layout for the overflow
exploit/exploit_src/main.cpp:943-1014 - Writes a payload into the overflow buffer that overwrites KernelCallbackTable+0x388 with a pointer to LoadLibraryA and the path to the attacker-controlled DLL
exploit/exploit_src/main.cpp:367-397 - Releases all spray objects to trigger the overflow in dwm.exe, causing it to load the payload DLL and execute code as SYSTEM
exploit/exploit_src/main.cpp:1039-1061 - Payload DLL spawns a cmd.exe process under the DWM process with SYSTEM integrity level and performs self-cleanup
exploit/payload/dllmain.cpp:78-127
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit mechanism for CVE-2024-30051, matching the repository's stated purpose.
exploit/exploit_src/main.cpp:158-169exploit/exploit_src/main.cpp:486-668exploit/exploit_src/main.cpp:943-1067 - Payload Behavior
- Payload withheldThe payload DLL's behavior is exactly what is described in the README and comments: it provides an interactive SYSTEM shell and cleans up after itself. No persistence or unrelated actions are taken.
exploit/payload/dllmain.cpp:78-127exploit/payload/dllmain.cpp:23-75 - File Path
- Payload withheldHardcoded payload DLL path used by the exploit and the setup script. This is a standard location for temporary files and is consistent with the exploit's need to place a DLL for DWM to load.
exploit/exploit_src/main.cpp:42README.md:87-88 - Log File
- Payload withheldThe exploit writes a detailed session log for debugging and academic purposes. This is a local log file, not an exfiltration channel.
exploit/exploit_src/main.cpp:60-85
What the analysis did not establish
- Evidence includes only 6 of 45 total files; 29 non-text media files and 10 unclassified files are not analyzed.
- The exploit binary is not provided; only source code is available.
- The payload DLL source is provided but the compiled DLL is not included in the evidence.
- Only the six text files included in the evidence packet were reviewed. The repository contains 39 other files (including 29 non-text media files and 10 unclassified files) that were not inspected. The review does not cover precompiled binaries, project files, or documentation images.
- The payload DLL's self-deletion behavior could be used to hide evidence of exploitation, but this is a common feature of post-exploitation tools and is not itself a backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubdevianntsec/CVE-2021-4034
Repository PoCStars: 1Created 2026-03-25ExploitCVE-2021-403413 files
Analysis
Technical assessment
A Python-based exploit for CVE-2021-4034 (PwnKit) that automates the creation, compilation, and execution of a local privilege escalation chain against polkit's pkexec. It includes multiple payloads (shell, backdoor, reverse shell, etc.) and a detailed technical writeup.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, an exploitation chain analysis document, and a Python exploit script for CVE-2021-4034 (PwnKit). All code and documentation describe legitimate local privilege escalation exploit behavior against the stated target (polkit's pkexec). The Python script provides multiple payloads (shell, backdoor_suid, add_root_user, reverse_shell, custom) that are standard post-exploitation actions performed with the elevated privileges obtained from the exploit. No concealed, deceptive, or operator-directed harm unrelated to the exploit's stated purpose was observed. The artifact does not contain hidden credential theft, unrelated remote access, persistence mechanisms beyond those explicitly documented as post-exploitation options, or any other backdoor behavior.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script (exploit/pwnkit.py) that automates the full exploitation chain for CVE-2021-4034. It generates, compiles, and executes C code to trigger the vulnerability and run attacker-chosen payloads (e.g., root shell, backdoor). This is code intended to exercise a vulnerability, not merely detect it.
exploit/pwnkit.py:1-476README.md:31Requirements
- Linux system with vulnerable polkit (version 0.105 or earlier)
README.md:70 - GCC compiler installed
README.md:71 - Python 3.6+
README.md:72 - Standard user account (no root required)
README.md:73
Observed behavior
- Generates and compiles a malicious shared library (pwnkit.so) with a payload (e.g., spawning a root shell, creating a SUID backdoor, adding a root user, or initiating a reverse shell).
exploit/pwnkit.py:85-281exploit/pwnkit.py:320-332 - Generates and compiles a helper executable (cve-2021-4034) that triggers the out-of-bounds write in pkexec by calling execve with an empty argv.
exploit/pwnkit.py:297-318exploit/pwnkit.py:329-332 - Sets up the required GCONV_PATH directory structure and gconv-modules configuration file to enable shared library loading by pkexec.
exploit/pwnkit.py:334-349 - Executes the compiled helper binary, which triggers the vulnerability in pkexec, leading to the execution of the attacker's payload with root privileges.
exploit/pwnkit.py:351-368
Behaviors behind the backdoor verdict
Observables
- Exploit Payloads
- Payload withheldThe Python script (exploit/pwnkit.py) offers multiple payloads that are standard post-exploitation actions executed with root privileges obtained via the CVE-2021-4034 exploit. These are explicitly documented and user-selectable.
exploit/pwnkit.py:90-279README.md:100-108 - Post Exploitation Actions
- Payload withheldThe README and script document post-exploitation modules (SUID backdoor, root user creation, reverse shell) that are part of the exploit's multi-payload framework. These are not hidden; they are presented as features of the exploit.
README.md:31-33exploit/pwnkit.py:150-262
What the analysis did not establish
- The evidence includes only three text files (README.md, exploitation chain analysis, and the Python exploit). The repository contains 10 other files (including 7 non-text media files and 3 unclassified files) that were not provided, so the analysis is based on a subset of the artifact.
- The evidence was not executed; classification is based solely on static analysis of the provided source code and documentation.
- 7 non-text media files (screenshots) were not analyzed; they are described as exploitation demonstrations in the README.
- 3 text files (docs/analysis/01-root-cause.md, docs/analysis/03-timeline.md, LICENSE) were not included in the evidence packet.
- 3 unclassified files (binary or other) were not analyzed.
- The review is limited to the supplied evidence and does not verify the behavior of compiled binaries or the exploit at runtime.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.