Mohnad-AL-saif

GitHub · Repository owner · Source ID 137708192
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

Mohnad-AL-saif/Gitea-Git-Hooks-RCE-CVE-2020-14144-

Repository PoC0Created 2026-02-14ExploitCVE-2020-141443 files

17.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is an automated Python exploit script (exploit.py) for CVE-2020-14144, which authenticates to a Gitea instance, creates a repository, injects a reverse shell payload into the post-receive git hook, and triggers execution by pushing a commit. A README provides usage instructions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2020-14144. The script performs authenticated remote code execution against a Gitea instance by injecting a user-supplied reverse shell payload into a git post-receive hook. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or deceptive operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareGitea
Attack typesAuthenticated Remote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, automated Python script (exploit.py) that exercises the CVE-2020-14144 vulnerability by performing authenticated remote code execution via git hook injection and push-based trigger. The README explicitly describes it as an exploit and provides usage examples for obtaining a reverse shell.

exploit.py:1-337README.md:1-4

Requirements

  • Valid Gitea credentials with 'May create git hooks' permissionexploit.py:309-310
  • Target Gitea instance version 1.1.0 through 1.12.5README.md:16
  • Network connectivity to target Gitea instance and attacker listenerexploit.py:325-326

Observed behavior

  • Authenticates to Gitea using supplied username and passwordexploit.py:88-120
  • Creates a new repository on the target Gitea instanceexploit.py:133-175
  • Injects a reverse shell payload into the repository's post-receive git hookexploit.py:177-209
  • Triggers the hook by cloning the repository, making a commit, and pushing it to the remoteexploit.py:241-278
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Payload
Payload withheldThe script generates a reverse shell payload using attacker-supplied IP and port, which is the core of the CVE-2020-14144 exploit.exploit.py:238
Credential Handling
Payload withheldThe script embeds the supplied username and password into the git remote URL to push the trigger commit without interactive prompt.exploit.py:260-261
Review boundaries

What the analysis did not establish

  • One file (MANUAL.md) is omitted from the evidence; its content is not available for analysis.
  • The evidence does not include any binary or non-text files.
  • The artifact's code was not executed; classification is based solely on static analysis of the provided source text.
  • One text file (MANUAL.md) was omitted from the evidence packet; its content was not reviewed.
  • One unclassified file (2589 bytes) was reported in metadata but not included; its content was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

Mohnad-AL-saif/Mohnad-AL-saif-CVE-2020-11107-XAMPP-Local-Privilege-Escalation

Repository PoC0Created 2026-01-29ExploitCVE-2020-111072 files

3.7 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a local privilege escalation exploit for CVE-2020-11107 in XAMPP on Windows. It includes a PowerShell script (50337.ps1) that modifies xampp-control.ini to replace the editor path with a malicious executable, and a README.md with step-by-step exploitation instructions including payload generation, transfer, configuration modification, trigger, and reverse shell capture.

Backdoor review

No backdoor observed in reviewed code

The repository contains a documented PoC for CVE-2020-11107, a local privilege escalation in XAMPP. The PowerShell script (50337.ps1) modifies xampp-control.ini to replace a configured executable path with a user-supplied payload. The README explains the vulnerability and provides exploitation steps. No concealed, deceptive, or unrelated harmful behavior was observed; the artifact performs exactly the advertised privilege escalation technique.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPowerShellMarkdown
Target softwareXAMPP
Attack typesLocal Privilege EscalationArbitrary Command Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a PowerShell script (50337.ps1) that actively modifies a system configuration file to replace a legitimate executable path with a malicious one, which is the core exploit action. The README.md provides a complete exploitation chain from payload generation to reverse shell capture, confirming the artifact's purpose is to exercise the vulnerability, not merely detect it.

50337.ps1:10-14README.md:63-129

Requirements

  • Low-privilege local access to a Windows system running a vulnerable XAMPP version (< 7.2.29, 7.3.x < 7.3.16, 7.4.x < 7.4.4).README.md:5-8
  • Ability to write to C:\xampp\xampp-control.ini.README.md:28
  • A malicious executable (e.g., msf.exe) placed at a known path on the target.README.md:65-80

Observed behavior

  • Reads the third line of xampp-control.ini and extracts the current editor path.50337.ps1:10-11
  • Replaces the extracted editor path with a hardcoded malicious executable path (payload withheld) in xampp-control.ini.50337.ps1:13-14
  • When an administrator opens a log via the XAMPP Control Panel, the malicious executable runs with the administrator's privileges.README.md:7-8
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Modification
Payload withheldThis is the core of the PoC: it swaps the editor executable path to achieve privilege escalation when an admin opens a log.50337.ps1:10-14
Payload Path
Payload withheldThe README instructs the user to generate and place a malicious executable at this path. The script itself does not create or fetch the payload.README.md:67-71README.md:77-80
Review boundaries

What the analysis did not establish

  • The evidence includes only the PowerShell script and README; no compiled payload (msf.exe) is provided.
  • The analysis treats the artifact as untrusted data; the code was not executed, and its reliability or safety is not verified.
  • Only the two text files (50337.ps1 and README.md) were supplied and reviewed; no other files from the repository were inspected.
  • The analysis does not execute the script or verify its runtime behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.