ngtuonghung
Source-scoped identity with 6 associated PoCs and 7 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
GitHubngtuonghung/CVE-2022-27666
Repository PoCStars: 0Created 2026-04-30ExploitCVE-2022-2766621 files
Analysis
Technical assessment
A local privilege escalation exploit for CVE-2022-27666, a heap buffer overflow in the Linux kernel's IPsec ESP6 implementation. The code performs heap grooming, triggers an out-of-bounds write via crafted ESP6 packets, leaks heap and kernel base addresses, and overwrites the modprobe_path to achieve root by executing a SUID binary.
Backdoor review
No backdoor observed in reviewed code
The supplied text evidence is a PoC exploit for CVE-2022-27666, a Linux kernel heap buffer overflow. The code performs heap grooming, triggers the vulnerability via ESP6 packets, leaks heap and kernel addresses, and overwrites modprobe_path to achieve local privilege escalation. No backdoor, deceptive payload, or concealed operator-directed harm is observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact contains complete C source code that actively exploits CVE-2022-27666 to achieve local privilege escalation. It includes heap grooming, out-of-bounds write triggers, information leaks, and a payload that overwrites modprobe_path to execute a root shell. This is not a scanner or writeup; it is functional exploit code.
exploit/main.c:687-728exploit/main.c:670-684Requirements
- Local user with normal privileges on a system running a vulnerable Linux kernel (5.13.19) with the esp6 module loaded.
README.md:3exploit/main.c:734-737 - Ability to create user namespaces or run as root for debugging.
exploit/main.c:691-693 - FUSE development libraries and kernel support for FUSE.
exploit/fuse_evil.c:7
Observed behavior
- Performs heap grooming by draining and spraying page allocator orders 2 and 3 to control memory layout.
exploit/main.c:329-387 - Sets up IPsec ESP6 policies and state to trigger the vulnerable code path.
exploit/esp.c:17-42 - Sends crafted UDP packets over IPv6 loopback to trigger an out-of-bounds write in the ESP6 output path.
exploit/main.c:223-263 - Leaks a heap address by overwriting a user key payload's datalen field and reading back adjacent msg_msg data.
exploit/main.c:389-489 - Leaks a kernel base address by overwriting a msg_msg header to point to a known kernel object and reading it back via msgrcv.
exploit/main.c:491-599 - Overwrites the modprobe_path kernel variable with a path to a SUID bash binary, then triggers modprobe to execute it and gain root.
exploit/main.c:622-685
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe exploit uses FUSE, user keys, message queues, and ESP6 packets to corrupt kernel memory and overwrite modprobe_path, then executes /tmp/bash with SUID privileges.
exploit/main.c:687-728 - File Operation
- Payload withheldThe arb_write function checks for a SUID /tmp/bash file and executes it with -p to gain a root shell, which is standard privilege escalation behavior.
exploit/main.c:672-683 - Binary Limitation
- Payload withheldThese binaries are flagged as uninspected. The text evidence shows they are copied from the VM and used as part of the FUSE-based exploit technique, but their internal behavior is not reviewed.
README.md:133-134
What the analysis did not establish
- Two binary files (fusermount3 and libfuse3.so.3) are present but not analyzed; their metadata is reported only.
- The evidence does not include the full kernel source or build artifacts; only the exploit source and a README with build instructions are provided.
- The exploit targets a specific kernel version (5.13.19) and configuration; reliability on other versions is unknown.
- Two binary files (exploit/bin/fusermount3, exploit/lib/libfuse3.so.3) are present but not analyzed; their contents could contain backdoor behavior not visible in the text evidence.
- 11 text files in the repository are omitted from the evidence packet and were not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubngtuonghung/CVE-2022-4543-EntryBleed
Repository PoCStars: 0Created 2026-04-18ExploitCVE-2022-45434 files
Analysis
Technical assessment
The artifact contains two C programs that implement a local exploit for CVE-2022-4543 (EntryBleed). The first program (entry.c) leaks the kernel base address (KASLR bypass) by measuring TLB timing side-channels on the kernel syscall entry. The second program (physmap.c) leaks the physical memory map (physmap) base address using a similar TLB timing side-channel. Together, these components constitute a working exploit to defeat KASLR and disclose sensitive kernel memory layout information.
Backdoor review
No backdoor observed in reviewed code
The repository contains a PoC for CVE-2022-4543 (EntryBleed) that leaks KASLR base and physmap base via prefetch side-channels. All provided source files (entry.c, physmap.c, Makefile) implement only the described side-channel attack and supporting utilities. No backdoor, trojan, or deceptive payload is observed.
Classification basis and observed behavior
Classification basis
The code actively exercises the EntryBleed vulnerability to leak kernel memory layout information (KASLR base and physmap base). It does not merely detect the vulnerability; it performs the side-channel attack and outputs the leaked addresses, which is the definition of an exploit.
entry.c:75-99physmap.c:232-284Requirements
- Local unprivileged code execution on an Intel system with KPTI enabled.
entry.c:1 - Access to syscall and high-resolution timers (rdtscp).
entry.c:19-45
Observed behavior
- Leaks kernel base address by scanning kernel text region with prefetch side-channel and syscall timing.
entry.c:47-73 - Leaks physmap base address by scanning physical memory direct mapping region with prefetch side-channel and syscall timing.
physmap.c:79-133 - Uses TLB timing differences to distinguish cached (kernel) addresses from uncached addresses.
entry.c:19-45physmap.c:45-71
Behaviors behind the backdoor verdict
Observables
- Side Channel Attack
- Payload withheldentry.c implements the EntryBleed attack to leak the kernel text base by measuring TLB timing differences on prefetch of potential syscall entry addresses.
entry.c:47-73 - Side Channel Attack
- Payload withheldphysmap.c implements a physmap base leak by scanning potential physmap addresses and refining candidates using TLB timing side-channel measurements.
physmap.c:79-230 - Build Instructions
- Payload withheldThe Makefile provides standard build instructions for the PoC binaries, with no unusual or hidden steps.
Makefile:1-16
What the analysis did not establish
- Evidence does not include the README.md file, which may contain additional context or usage instructions.
- The exploit's effectiveness depends on specific hardware and kernel configurations not verified in the evidence.
- One file (13 bytes, unclassified) is omitted from text analysis; its content is unknown but unlikely to contain a backdoor given the small size and the complete coverage of the main source files.
- Binary files are not analyzed; the review is limited to the provided source text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubngtuonghung/CVE-2026-27940
Repository PoCStars: 0Created 2026-03-29ExploitCVE-2026-279406 files
Analysis
Technical assessment
The artifact generates a malicious GGUF file (payload withheld) designed to trigger an integer overflow and subsequent heap buffer overflow in llama.cpp's gguf_init_from_file_impl(). The generated file is then loaded by a vulnerable version of the library to demonstrate the crash.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a C program that generates a malformed GGUF file to trigger CVE-2026-27940 and a shell script that builds and runs the PoC with a debugger. No backdoor, deceptive payload, or concealed harmful behavior is present. The code performs only the advertised vulnerability demonstration.
Classification basis and observed behavior
Classification basis
The artifact includes code that generates a malicious input file (poc.c) and a script (run.sh) that builds and runs the vulnerable target with that input to trigger the vulnerability. This constitutes an exploit as it exercises the vulnerability to cause a crash.
CVE-2026-27940 POC/poc.c:23-91CVE-2026-27940 POC/run.sh:1-53Requirements
- Requires a vulnerable version of llama.cpp (prior to b8146) to be built and available.
CVE-2026-27940 POC/run.sh:7 - Requires the ggml static libraries to be built from the vulnerable source.
CVE-2026-27940 POC/run.sh:10-21
Observed behavior
- Generates a GGUF file with a crafted tensor dimension (ne0) calculated to cause an integer overflow in mem_size, leading to an undersized heap allocation.
CVE-2026-27940 POC/poc.c:29-35CVE-2026-27940 POC/poc.c:63 - Writes attacker-controlled data (0x41 bytes) into the generated file, which will be read past the undersized buffer boundary by the vulnerable fread() call.
CVE-2026-27940 POC/poc.c:83-85 - Executes the vulnerable llama-gguf binary with the crafted file under GDB to demonstrate the crash.
CVE-2026-27940 POC/run.sh:51-53
Behaviors behind the backdoor verdict
Observables
- File Write
- Payload withheldThe PoC writes a crafted GGUF file with oversized tensor dimensions to trigger the integer overflow and heap buffer overflow described in CVE-2026-27940.
CVE-2026-27940 POC/poc.c:40-88 - Command Execution
- Payload withheldThe shell script launches the vulnerable gguf example under GDB to observe the crash caused by the PoC file.
CVE-2026-27940 POC/run.sh:53
What the analysis did not establish
- The evidence does not include the GDB script (script.gdb) referenced in run.sh, so the exact debugging commands are unknown.
- The evidence does not include the gguf.h or ggml.h headers, so the exact definitions of GGML_PAD, GGUF_DEFAULT_ALIGNMENT, and ggml_tensor_overhead are not confirmed.
- The evidence does not include the vulnerable llama.cpp source code, so the exact vulnerable code path cannot be verified.
- Three additional files in the repository (total 6 files) were not included as text in the evidence packet; their content is unknown.
- The evidence does not include the GDB script (script.gdb) referenced in run.sh, so its exact commands are not reviewed.
- Binary files were flagged as metadata-only and not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubngtuonghung/CVE-2021-3156
Repository PoCStars: 0Created 2026-03-19ExploitCVE-2021-315644 files
Analysis
Technical assessment
The artifact is a Python exploit for CVE-2021-3156 (Sudo Baron Samedit). It constructs a malicious command line and environment variables to trigger a heap-based buffer overflow in sudoedit, then uses a shared library loaded via LC_* environment variables to copy /bin/bash to a temporary path and set the SUID bit, achieving local privilege escalation to root.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2021-3156 (Sudo heap-based buffer overflow). The exploit.py script compiles a shared library that copies /bin/bash to a temporary path and sets the SUID bit, then triggers the vulnerability to execute this library via the sudoedit command. The behavior is consistent with a local privilege escalation exploit against the disclosed CVE. No concealed, deceptive, or unrelated harmful actions were observed.
Classification basis and observed behavior
Classification basis
The Python script exploit.py actively constructs and executes a payload to trigger CVE-2021-3156 and escalate privileges, which is the definition of an exploit. It does not merely detect or report the vulnerability.
exploit.py:1-83Requirements
- Local user access to a system with a vulnerable version of sudo installed at payload withheld.
exploit.py:35 - Ability to compile C code (gcc) and write to /tmp.
exploit.py:30-33
Observed behavior
- Writes a C payload to /tmp/pwn.c that copies /bin/bash to a random path in /tmp and sets the SUID bit.
exploit.py:9-33 - Compiles the C payload as a shared library (libnss_pwn/pwn.so.2).
exploit.py:33 - Executes sudoedit with crafted arguments and environment variables designed to trigger the buffer overflow and load the malicious shared library.
exploit.py:35-68 - Checks for the existence of the SUID bash copy and, if present, executes it with -p to gain a root shell.
exploit.py:79-81
Behaviors behind the backdoor verdict
Observables
- Local Privilege Escalation
- Payload withheldThis is the disclosed exploit behavior for CVE-2021-3156, targeting the local host running the PoC.
exploit.py:8-25exploit.py:33exploit.py:35exploit.py:79-81 - File Path
- Payload withheldThe exploit targets a non-standard sudoedit path, which may indicate a specific test environment.
exploit.py:35
What the analysis did not establish
- One binary file (sudo-1.8.31p2.tar.gz) was flagged but not analyzed; it may contain additional exploit variants or vulnerable source code.
- Only 4 of 44 repository files were provided as text; the remaining 39 text files were omitted, which could include additional documentation, build scripts, or exploit variants.
- One binary file (sudo-1.8.31p2.tar.gz) was not inspected; it is the source archive of the vulnerable sudo version and is not expected to contain backdoor logic.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubngtuonghung/nimbuspwn-CVE-2022-29800-CVE-2022-29799
Repository PoCStars: 0Created 2025-11-09ExploitCVE-2022-29799CVE-2022-298002 files
Analysis
Technical assessment
A Python script that exploits CVE-2022-29799 (directory traversal) and CVE-2022-29800 (TOCTOU race condition) in networkd-dispatcher to achieve local privilege escalation by replacing root-owned executables with a payload that creates a setuid root shell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script (exploit.py) targeting CVE-2022-29799 and CVE-2022-29800 in networkd-dispatcher. The script performs a local privilege escalation by exploiting a directory traversal and a TOCTOU race condition to write a payload that copies /bin/sh to /tmp/sh and sets the setuid bit. All behavior is consistent with the stated exploit goals; no concealed backdoor, unrelated payload, or operator-directed harm beyond the documented PoC is observed.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerabilities by sending malicious D-Bus signals and performing symlink swaps to execute attacker-controlled code with elevated privileges, resulting in a root shell. This is exploitation, not mere detection or scanning.
exploit.py:48-95Requirements
- Local low-privileged user access to a system running vulnerable networkd-dispatcher.
exploit.py:1-95 - Ability to send D-Bus signals on the system bus (requires local access).
exploit.py:60-69
Observed behavior
- Registers a fake D-Bus service 'org.freedesktop.network1' to impersonate systemd-networkd.
exploit.py:20-24 - Creates a temporary directory with a symlink 'poc.d' pointing to '/sbin'.
exploit.py:26-29 - Sends a crafted D-Bus PropertiesChanged signal with a directory traversal path in OperationalState to trigger networkd-dispatcher to read scripts from the attacker-controlled directory.
exploit.py:60-69 - Exploits a TOCTOU race condition by replacing the symlink after networkd-dispatcher discovers scripts but before it executes them, causing it to execute attacker-written payloads instead of legitimate root-owned binaries.
exploit.py:72-80 - Payload creates a setuid root shell at /tmp/sh.
exploit.py:12-16 - Checks for successful exploitation by verifying existence of /tmp/sh and spawns a root shell.
exploit.py:82-85
Behaviors behind the backdoor verdict
Observables
- Payload
- Payload withheldThe payload written by the exploit creates a setuid root shell at /tmp/sh, which is the expected outcome of a local privilege escalation PoC for the targeted CVEs.
exploit.py:12-16 - Exploit Mechanism
- Payload withheldThe script creates a symlink to /sbin, sends a crafted D-Bus signal to trigger networkd-dispatcher to read scripts from the symlink path, then swaps the symlink to point to the attacker's directory containing the payload. This matches the described CVE-2022-29800 race condition.
exploit.py:26-46exploit.py:58-77 - Exploit Mechanism
- Payload withheldThe script sends a PropertiesChanged signal with an OperationalState containing a path traversal (../../..) to escape the base directory, matching CVE-2022-29799.
exploit.py:60-69
What the analysis did not establish
- Evidence is limited to static source code analysis; no runtime behavior or environment was observed.
- The exploit targets a specific Linux component (networkd-dispatcher) and may not function on all distributions or versions.
- The race condition exploit may require multiple attempts and is not guaranteed to succeed on every run.
- Only the two text files (README.md and exploit.py) were reviewed; no binary or other files were present in the evidence.
- The review does not assess whether the exploit actually works or is safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubngtuonghung/CVE-2022-0324
Repository PoCStars: 0Created 2025-11-09ExploitCVE-2022-03244 files
Analysis
Technical assessment
The artifact contains a Python script (exploit.py) that crafts and sends a malicious DHCPv6 RELAY-REPL packet with an oversized option length to a target IP and port, intended to trigger a buffer overflow in dhcp6relay as described in CVE-2022-0324.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Dockerfile, README, and a Python exploit script for CVE-2022-0324. The exploit script constructs and sends a DHCPv6 relay-reply packet with an oversized option length to trigger a buffer overflow in dhcp6relay, consistent with the described vulnerability. No concealed backdoor, persistence, credential theft, or unrelated payload is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
The file exploit.py actively constructs and sends a malicious network packet designed to exploit CVE-2022-0324, which is a buffer overflow vulnerability. This is direct exploitation code, not a scanner or writeup.
exploit.py:1-20Requirements
- Target running vulnerable dhcp6relay service on UDP port 547 at the specified IPv6 address.
exploit.py:4-5exploit.py:18-20 - Python 3 environment with socket support.
exploit.py:1-2
Observed behavior
- Constructs a DHCPv6 RELAY-REPL message with a crafted OPTION_RELAY_MSG option where the length field is set to 65535 (0xFFFF), exceeding the actual data length, to trigger a buffer overflow in memcpy.
exploit.py:10-16 - Sends the crafted packet via IPv6 UDP to the target address 2a00:7b80:451:1::10 on port 547.
exploit.py:18-20
Behaviors behind the backdoor verdict
Observables
- Exploit Script
- Payload withheldDemonstrates the CVE-2022-0324 buffer overflow by sending a packet with option_length set to 65535 and a payload of 2^15 bytes, which can trigger an out-of-bounds write in dhcp6relay.
exploit.py:1-20 - Build Environment
- Payload withheldSets up a vulnerable environment for reproducing CVE-2022-0324, including building the affected component and configuring Redis.
Dockerfile:1-44 - External Reference
- Payload withheldREADME points to an external blog post likely detailing the vulnerability reproduction, but the content is not included in the evidence.
README.md:1-3
What the analysis did not establish
- The Dockerfile and README.md provide build and reference context but do not contain exploit logic.
- The evidence does not include the add_ipv6_addresses.sh script or the full repository contents.
- The exploit script targets a hardcoded IP address and may not be directly usable without modification.
- The file add_ipv6_addresses.sh is referenced in the Dockerfile but its content is not provided in the evidence. Its behavior cannot be assessed.
- The external blog post linked in README.md is not included and its content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.