nehkark
Source-scoped identity with 5 associated PoCs and 6 linked vulnerabilities.
Exploit catalog results
Showing 5 PoCs on this page
GitHubnehkark/CVE-2025-68613
Repository PoCStars: 0Created 2025-12-23ScannerCVE-2025-686134 files
Analysis
Technical assessment
A Python-based scanner that detects vulnerable n8n instances by extracting the version from /signin metadata and checking it against known vulnerable ranges. It also includes a safe PoC that queries /rest/settings to confirm metadata exposure, which is presented as a correlation with weakened isolation, but does not perform or demonstrate remote code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python script that perform version fingerprinting and a metadata exposure check against n8n instances. The script makes only HTTP GET requests to /signin and /rest/settings, parses responses, and prints results. No backdoor, concealed executable behavior, or operator-directed harm is present. The code is transparent and limited to the described safe PoC functionality.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is detection and validation. It extracts the n8n version, checks it against vulnerable ranges, and queries an unauthenticated endpoint to confirm metadata exposure. The README explicitly states it does not provide exploitation and the code contains no RCE payload or exploitation logic. This matches the definition of a scanner.
README.md:18-24README.md:44-65cve-2025-68613.py:4-8cve-2025-68613.py:139-191Requirements
- Network access to the target n8n instance's /signin and /rest/settings endpoints.
cve-2025-68613.py:52-87cve-2025-68613.py:106-114
Observed behavior
- Fetches the /signin page and extracts the n8n version from a Base64-encoded meta tag.
cve-2025-68613.py:52-87 - Compares the extracted version against known vulnerable ranges (0.211.0 to <1.120.4 and 1.121.0 to <1.121.1).
cve-2025-68613.py:93-100 - If the version is vulnerable, optionally queries /rest/settings to retrieve and display internal configuration metadata without authentication.
cve-2025-68613.py:106-131
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldUsed to extract n8n version from Base64-encoded metadata in the page.
cve-2025-68613.py:54-60 - Network Request
- Payload withheldUsed to retrieve internal configuration metadata as part of the safe PoC.
cve-2025-68613.py:108-114 - Author Contact
- Payload withheldContact information provided in the README; not indicative of backdoor behavior.
README.md:248-252
What the analysis did not establish
- Two files (total 4) are reported as omitted from the text content; their content is unknown.
- The artifact's safe PoC only demonstrates unauthenticated metadata exposure, not the actual RCE vector described in the CVE.
- Two files in the repository were classified as binary/unclassified and were not analyzed (metadata only). Their content is unknown, but the analysis scope reports 0 binary files uninspected and complete coverage for readable selected text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubnehkark/CVE-2025-55182
Repository PoCStars: 7Created 2025-12-05ExploitCVE-2025-55182CVE-2025-6647811 files
Analysis
Technical assessment
The artifact contains a Python script (poc-cve-2025-55182.py) that sends a crafted React Flight payload to a target Next.js server to achieve unauthenticated remote code execution (RCE) by exploiting unsafe deserialization in React Server Components (CVE-2025-55182). The README documents the script's usage and shows successful command execution output.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and a Python PoC script (poc-cve-2025-55182.py) that demonstrate exploitation of CVE-2025-55182, a React Server Components deserialization vulnerability. The script sends a crafted multipart request to trigger remote code execution via a NEXT_REDIRECT error digest. All behavior is consistent with the stated purpose of demonstrating the CVE; no concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the declared exploit is present.
Classification basis and observed behavior
Classification basis
The primary artifact is the Python script poc-cve-2025-55182.py, which is explicitly designed to send a malicious payload to a vulnerable server to execute arbitrary commands. This constitutes exploit code as it exercises the vulnerability to achieve remote code execution, not merely detecting or reporting it.
poc-cve-2025-55182.py:1-9poc-cve-2025-55182.py:29-58README.md:134-136Requirements
- Target must be running a vulnerable version of Next.js with React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) and have a Server Function endpoint accessible.
README.md:9-11poc-cve-2025-55182.py:5
Observed behavior
- The script constructs a multipart form-data payload containing a crafted JSON object that exploits React Flight deserialization to execute an arbitrary shell command via Node.js child_process.execSync.
poc-cve-2025-55182.py:29-58 - The payload is sent as a POST request to the target URL with a 'Next-Action: x' header, triggering the Server Action endpoint.
poc-cve-2025-55182.py:117-129 - The script extracts the command output from the 'digest' field of the server's error response body, confirming successful remote code execution.
poc-cve-2025-55182.py:61-71poc-cve-2025-55182.py:139-142 - The README shows example runs of the exploit script executing 'uname -a', 'whoami', and 'id' on a Docker container, returning the command output.
README.md:143-183
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThis is the core exploit mechanism for CVE-2025-55182, matching the described vulnerability.
poc-cve-2025-55182.py:40-44 - Command Execution
- Payload withheldDemonstrates the RCE impact of the CVE; no evidence of commands being executed for unrelated purposes.
README.md:143-183
What the analysis did not establish
- Only two of eleven repository files were provided as text; the remaining nine files (including middleware.js, Dockerfile, and NextJs.py) are omitted, so the full laboratory setup and the passive scanner script cannot be analyzed.
- The evidence does not include the actual execution of the exploit; the README output is presented as documentation, not as a verified runtime trace.
- Only two of eleven repository files were provided as readable text; nine files (including Dockerfile, package.json, middleware.js, and app route files) are present only as metadata and were not reviewed.
- Binary analysis was not performed; the evidence policy states binary files are flagged metadata-only and not analyzed.
- The review is limited to static analysis of the supplied text; no dynamic execution or network behavior was observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubnehkark/CVE-2025-62168
Repository PoCStars: 0Created 2025-11-25ExploitCVE-2025-621687 files
Analysis
Technical assessment
The artifact is a Python script that exploits CVE-2025-62168 in Squid Proxy by sending a request with a controlled JWT token in a custom header, forcing an error page, and extracting the reflected token from the mailto diagnostic block.
Backdoor review
No backdoor observed in reviewed code
The PoC demonstrates the described CVE-2025-62168 information disclosure by sending a crafted request through a Squid proxy and parsing the error page for a reflected token. No backdoor, concealed payload, or unrelated harmful behavior was observed in the reviewed text files.
Classification basis and observed behavior
Classification basis
The script actively sends a crafted request to trigger the vulnerability and extracts the leaked credential from the response, which constitutes exploitation, not just detection.
cve-2025-62168.py:49-83cve-2025-62168.py:100-114README.md:10-19Requirements
- A vulnerable Squid Proxy instance (versions < 7.2) with email_err_data enabled (default configuration).
README.md:23-25 - Network access to the Squid Proxy.
cve-2025-62168.py:49-51
Observed behavior
- Sends an HTTP request through the specified proxy to a non-existent domain, including a JWT token in a custom X-Test-Leak header.
cve-2025-62168.py:49-67 - Receives the Squid-generated error page HTML response.
cve-2025-62168.py:70-79 - Parses the HTML to find the mailto: link containing the reflected request headers.
cve-2025-62168.py:89-94 - Extracts the leaked JWT token from the mailto link body.
cve-2025-62168.py:100-114 - Decodes the JWT token header and payload and prints them.
cve-2025-62168.py:120-131
Behaviors behind the backdoor verdict
Observables
- Hardcoded Test Token
- Payload withheldA demo JWT token used as the injected header value to test the leak. It is hardcoded in the PoC script and does not represent a real credential.
cve-2025-62168.py:35-40 - Target Url
- Payload withheldThe URL used to trigger a Squid error page. It points to a non-existent domain to force an error response.
cve-2025-62168.py:51 - Author Contact
- Payload withheldContact information provided by the author in the README. This is not inherently malicious.
README.md:127-131
What the analysis did not establish
- The evidence packet does not include the contents of 4 text files (LICENSE, example.txt, payload.json, token.txt) and 0 binary files, but the provided Python script and README are complete and sufficient for classification.
- The analysis treats the code as untrusted data and does not execute it; classification is based solely on static review of the supplied source code and documentation.
- Four files from the repository (LICENSE, example.txt, payload.json, token.txt) were not included in the evidence packet and were not reviewed. Their content is unknown.
- The review is limited to static analysis of the provided text; the script was not executed, and no dynamic behavior was observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubnehkark/CVE-2025-10230
Repository PoCStars: 1Created 2025-11-23ExploitCVE-2025-102305 files
Analysis
Technical assessment
The artifact is a Python script that crafts and sends a NetBIOS Name Registration packet to a target Samba WINS server. The script is designed to inject a user-supplied NetBIOS name into the server's 'wins hook' shell command, demonstrating remote command execution for CVE-2025-10230.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a README and a Python script that constructs and sends a NetBIOS Name Registration packet to a target WINS server. The script takes user-supplied arguments (target IP, NetBIOS name, source IP) and sends them over UDP. It does not execute any shell commands, establish persistence, exfiltrate data, or contact any unrelated remote hosts. The behavior is consistent with a legitimate demonstration of the described CVE-2025-10230 vulnerability.
Classification basis and observed behavior
Classification basis
The Python script actively sends a crafted network packet to trigger a command injection vulnerability on a remote server. The script's own output refers to the action as an 'exploit' and the README describes it as a 'Proof-of-Concept (PoC)' that 'demonstrates how specially crafted NetBIOS Name Registration packets can trigger arbitrary shell commands'. This is code intended to exercise a vulnerability, not merely detect it.
poc/cve-2025-10230.py:205-207README.md:10README.md:19Requirements
- Target Samba server must have 'wins support = yes' and a non-empty 'wins hook' parameter configured.
README.md:14-15 - Attacker must be able to send UDP packets to port 137 on the target.
poc/cve-2025-10230.py:120-122
Observed behavior
- Constructs a NetBIOS Name Registration packet with a user-provided name.
poc/cve-2025-10230.py:48-99 - Sends the crafted packet to the target WINS server on UDP port 137.
poc/cve-2025-10230.py:102-132 - The script's output messages describe the action as sending an 'exploit'.
poc/cve-2025-10230.py:205-207
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe script sends a crafted NetBIOS packet to the target specified by the user via the -t argument. This is the expected behavior for a PoC demonstrating the WINS hook vulnerability.
poc/cve-2025-10230.py:120-122 - User Input
- Payload withheldThe script accepts user-provided target IP, port, NetBIOS name, source IP, and name type. These are used solely to construct the demonstration packet and are not used for any other purpose.
poc/cve-2025-10230.py:147-177
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false; 3 files (7414 bytes) are unclassified and not included in the analysis.
- The analysis is based solely on the provided text content; the code was not executed, and its effectiveness or safety is not verified.
- Three files (evidence/logs.md, conf/smb.conf, and one other) were present in the repository but their content was not provided for review. The analysis is limited to the README.md and poc/cve-2025-10230.py files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubnehkark/CVE-2025-40778
Repository PoCStars: 4Created 2025-10-29WriteupCVE-2025-407786 files
Analysis
Technical assessment
The artifact is a technical writeup describing CVE-2025-40778, a DNS cache poisoning vulnerability in BIND 9. It includes a detailed vulnerability description, attack scenarios, mitigation strategies, and references. The repository's README and other text files reference exploit scripts (payload withheld) and show their output, but the actual executable code for these scripts is not included in the supplied evidence packets.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of documentation and configuration files describing a proof-of-concept for CVE-2025-40778, a DNS cache poisoning vulnerability. The text files (CVE-2025-40778.md, README.md, readme.txt, requirements.txt) contain educational explanations, setup instructions, and example command-line invocations for the PoC scripts. No executable code, obfuscated payloads, or concealed backdoor behavior is present in the reviewed text. The PoC scripts themselves (payload withheld) are not included in the text evidence, so their behavior cannot be assessed, but the documentation describes only expected DNS manipulation consistent with the claimed vulnerability. No findings of deceptive or harmful behavior were identified.
Classification basis and observed behavior
Classification basis
The supplied evidence consists entirely of documentation files (CVE-2025-40778.md, README.md, readme.txt, requirements.txt). These files describe the vulnerability, attack scenarios, and mitigation, and reference exploit scripts (payload withheld) but do not contain the source code for those scripts. The content is a substantive technical analysis without executable exploit or scanner code, which matches the definition of a writeup.
CVE-2025-40778.md:1-476README.md:1-265readme.txt:50-55Requirements
- A compromised or malicious authoritative nameserver that can inject out-of-zone records into DNS responses.
CVE-2025-40778.md:21 - A vulnerable recursive DNS resolver (BIND 9) that lacks proper bailiwick checking and caches the injected records.
CVE-2025-40778.md:31
Observed behavior
- The writeup describes how a malicious authoritative nameserver can inject unrelated DNS records into a response, which a vulnerable recursive resolver will cache, poisoning its cache for future queries.
CVE-2025-40778.md:21CVE-2025-40778.md:31 - The README shows console output from running the PoC scripts, including a malicious server log indicating a poisoned record was sent and a dig query showing the legitimate answer.
README.md:163-167README.md:192-193
Behaviors behind the backdoor verdict
Observables
- Contact Information
- Payload withheldAuthor contact details provided in documentation; not indicative of backdoor behavior.
CVE-2025-40778.md:431-433README.md:38-40 - Missing Executable Code
- Payload withheldThe PoC scripts are referenced but their source code is not included in the reviewed text evidence; their behavior cannot be verified.
readme.txt:51-52CVE-2025-40778.md:380-381
What the analysis did not establish
- The evidence packets do not include the content of the auth_poison.py and validate_poc_forwarder.py scripts, which are referenced as the main PoC exploit and validation tool. Only their output and descriptions are present.
- The packet metadata indicates 2 files were omitted from the text content, which likely correspond to the missing Python scripts.
- The actual PoC scripts (payload withheld) are not included in the text evidence; their source code was not reviewed. The verdict applies only to the supplied documentation files.
- Two files (metadata only) were omitted from the text evidence and not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.