HackingLZ
Source-scoped identity with 3 associated PoCs and 4 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubHackingLZ/wp2shell_stock_chain
Repository PoCStars: 3Created 2026-07-18ExploitCVE-2026-60137CVE-2026-6303011 files
Analysis
Technical assessment
A Python exploit for CVE-2026-60137 and CVE-2026-63030 in WordPress. It uses a REST API batch-route confusion to deliver a SQL injection via the author__not_in parameter, creates an administrator account, and then uploads and executes a one-shot plugin to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a proof-of-concept exploit for CVE-2026-60137 and CVE-2026-63030. The code performs the documented SQL injection and REST API chain to create an administrator, then optionally uploads and activates a one-shot plugin that runs only the fixed command 'id' and self-removes. No concealed executable behavior, unrelated remote access, persistence, credential theft, or deceptive payload was observed. The plugin is generated locally, restricted to administrator-only access, and contains no arbitrary command input.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, functional Python script (exploit.py) that actively exploits CVE-2026-60137 and CVE-2026-63030 to achieve SQL injection and remote code execution. It includes all necessary logic for the attack chain: SQL injection, administrator creation, login, plugin upload, and command execution. The README explicitly describes it as a 'proof of concept' and provides usage examples for exploitation.
README.md:3-4exploit.py:1-971Requirements
- Target must be a vulnerable WordPress instance (6.8.x < 6.8.6, 6.9.x < 6.9.5, 7.0.x < 7.0.2).
README.md:101-103 - Target must have at least one public post that can be oEmbedded.
README.md:69-70 - The default non-persistent WordPress object cache is expected.
README.md:69
Observed behavior
- Sends a crafted batch REST API request to exploit a route confusion and inject SQL via the author__not_in parameter.
exploit.py:144-181 - Uses UNION-based SQL injection to exfiltrate data, discover the table prefix, and find an existing administrator ID.
exploit.py:237-243exploit.py:271-280exploit.py:283-295 - Creates a new administrator account via a nested batch request that carries the SQL injection and a user creation payload.
exploit.py:184-234exploit.py:480-540 - Logs in as the new administrator, uploads a custom or built-in PHP plugin, activates it, and invokes a REST route to execute the shell command 'id'.
exploit.py:568-597exploit.py:708-753exploit.py:765-796 - The built-in proof plugin runs 'id', deactivates itself, and deletes its own file and directory.
exploit.py:628-681
Behaviors behind the backdoor verdict
Observables
- Fixed Command Execution
- Payload withheldThe generated proof plugin runs only the fixed command 'id' and has no mechanism for arbitrary command input.
exploit.py:642-643 - Self Removal
- Payload withheldThe proof plugin deactivates itself and removes its file and directory after execution, leaving no persistent webshell.
exploit.py:664-671 - Target Restriction
- Payload withheldExecution modes (--exec, --complete-chain) are restricted to loopback and private-network targets.
exploit.py:543-561 - Permission Check
- Payload withheldThe proof plugin's REST route requires administrator-level capabilities.
exploit.py:637-639
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that 8 files (38,362 bytes) were not included in the analysis. The classification is based solely on the provided text files (README.md, exploit.py, test_exploit.py).
- The artifact's execution modes are restricted to loopback and private-network targets by a guard function, but the exploit code itself is not restricted.
- The built-in RCE proof is limited to executing the fixed command 'id' and does not accept arbitrary commands.
- 8 unclassified files totaling 38,362 bytes were not inspected; their content and potential behavior are unknown.
- Binary files were flagged as metadata-only and not analyzed.
- The review is limited to the supplied text evidence and does not verify runtime behavior or network interactions.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackingLZ/CVE-2025-27237
Repository PoCStars: 20Created 2026-01-26ExploitCVE-2025-272378 files
Analysis
Technical assessment
The artifact provides a complete proof-of-concept exploit for CVE-2025-27237, a local privilege escalation in Zabbix Agent for Windows via OpenSSL config hijacking. It includes step-by-step instructions to create a malicious openssl.cnf and a DLL payload (poc.c) that writes a proof file and shows a MessageBox, achieving arbitrary code execution as SYSTEM.
Backdoor review
No backdoor observed in reviewed code
The supplied text files describe a legitimate proof-of-concept for CVE-2025-27237, a local privilege escalation in Zabbix Agent for Windows. The PoC demonstrates loading a user-supplied DLL via a malicious OpenSSL configuration file. The DLL source code (poc.c) performs only benign proof-of-execution actions: writing a timestamped file to payload withheld and optionally displaying a MessageBox. No concealed, deceptive, or operator-directed harmful behavior (such as credential theft, persistence, or unrelated remote access) is present in the reviewed evidence.
Classification basis and observed behavior
Classification basis
The primary artifact is a PoC that provides complete exploit code (poc.c) and step-by-step instructions to achieve arbitrary code execution as SYSTEM. The DLL payload performs observable malicious actions (file write, MessageBox), which is characteristic of an exploit, not merely a scanner or writeup.
CVE-2025-27237-PoC.md:1-5CVE-2025-27237-PoC.md:58-93CVE-2025-27237-PoC.md:108-114Requirements
- Local user access to Windows system with Zabbix Agent installed
CVE-2025-27237-PoC.md:24 - Zabbix Agent configured with TLS (TLSConnect=cert or TLSAccept=cert)
CVE-2025-27237-PoC.md:25 - Ability to create directories at C:\ root (default Windows permissions allow this)
CVE-2025-27237-PoC.md:26
Observed behavior
- Creates directory structure C:\vcpkg\downloads\tools\msys2\2db36fb050d01f45\etc\ssl
CVE-2025-27237-PoC.md:32-34 - Creates malicious openssl.cnf that loads a DLL via OpenSSL provider directive
CVE-2025-27237-PoC.md:40-52 - Compiles a malicious DLL (poc.c) that writes payload withheld and shows a MessageBox on DLL_PROCESS_ATTACH
CVE-2025-27237-PoC.md:58-93 - Deploys poc.dll to the vulnerable path and triggers execution by restarting Zabbix Agent service
CVE-2025-27237-PoC.md:101-114 - Verifies exploitation by checking for payload withheld proof file
CVE-2025-27237-PoC.md:116-128
Behaviors behind the backdoor verdict
Observables
- File Write
- Payload withheldThe PoC DLL writes a proof-of-exploitation file to payload withheld, which is a benign indicator of successful code execution.
CVE-2025-27237-PoC.md:64-77 - Message Box
- Payload withheldThe PoC DLL optionally displays a MessageBox, which is a benign, visible proof of execution.
CVE-2025-27237-PoC.md:80-84 - Dll Export
- Payload withheldThe DLL exports payload withheld, which is required for OpenSSL provider loading and is consistent with the documented exploitation technique.
CVE-2025-27237-PoC.md:90-92
What the analysis did not establish
- The evidence packet does not include the actual compiled DLL or the extract_openssl_paths.py script; only source code and documentation are provided.
- The analysis_scope reports 5 unclassified files (likely the .c and .py files) that are not included in the selected text, so the full source of poc2.c, poc3.c, and extract_openssl_paths.py is not available for review.
- Five files in the repository were not included as text in the evidence packet and were not reviewed. The inventory lists poc.c, poc2.c, poc3.c, and extract_openssl_paths.py as present but their content was not supplied. The analysis scope notes binary files were flagged as metadata-only and not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.