RIZZZIOM

GitHub · Repository owner · Source ID 124419659
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

RIZZZIOM/CVE-2024-30167

Repository PoC1Created 2025-12-27ExploitCVE-2024-301673 files

9.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Go-based authenticated remote command injection exploit targeting Atlona AT-OME-RX21 AV switcher firmware <= 1.5.1 via the /cgi-bin/time.cgi endpoint. The code sends a crafted JSON payload with a command injection in the serverName parameter, starts a local HTTP listener to receive command output, and executes arbitrary OS commands as root.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Go-based proof-of-concept (PoC) for CVE-2024-30167, an authenticated command injection vulnerability in Atlona AV switchers. The code sends a crafted JSON payload to the target's /cgi-bin/time.cgi endpoint, injecting a command that exfiltrates output to a listener controlled by the operator. All behavior is consistent with the stated exploit purpose: no concealed backdoor, persistence, credential theft, or unrelated payload was observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesGo
Target softwareAtlona AT-OME-RX21
Attack typescommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by sending a crafted payload that injects and executes an arbitrary OS command on the target, and then retrieves the output. This is not merely checking for the vulnerability; it performs the full exploitation chain.

main.go:95-134main.go:136-157

Requirements

  • Valid credentials for the target Atlona device (default admin:Atlona).main.go:41-42
  • Network access to the target device's /cgi-bin/time.cgi endpoint.main.go:54
  • Attacker must run a listener reachable by the target to receive command output.main.go:44

Observed behavior

  • Constructs a JSON payload with a command injection in the serverName field, appending a curl command that POSTs the output of the attacker-supplied command back to the attacker's listener.main.go:97
  • Sends the payload via HTTP POST with Basic authentication to the target's /cgi-bin/time.cgi.main.go:98-106
  • Starts an HTTP server on the attacker-controlled host and port to receive the command output from the target.main.go:159-185
  • Prints the received command output to stdout.main.go:143-150
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
Payload withheldThe payload injects an operator-supplied command into the serverName parameter and exfiltrates the output via curl to a listener host:port specified by the operator.main.go:97
Listener
Payload withheldThe PoC starts an HTTP server to receive the command output sent by the compromised target. This is standard for blind command injection exploits.main.go:159-185
Authentication
Payload withheldThe exploit uses HTTP Basic authentication to access the vulnerable endpoint, consistent with the CVE description of an authenticated command injection.main.go:98-105
Review boundaries

What the analysis did not establish

  • Evidence consists of complete source code and README; no binary or opaque content. No execution or dynamic analysis was performed.
  • Only the three text files (README.md, go.mod, main.go) were reviewed; no binary artifacts were present or analyzed.
  • The review does not assess whether the exploit works as claimed or whether the target device is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

RIZZZIOM/CVE-2021-27905

Repository PoC2Created 2025-10-18ExploitCVE-2021-279055 files

4.3 MiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends an HTTP request to a vulnerable Apache Solr instance's ReplicationHandler with a user-supplied masterUrl parameter to trigger a Server-Side Request Forgery (SSRF).

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2021-27905, an SSRF vulnerability in Apache Solr. The Python script (cve-2021-27905.py) sends a crafted HTTP request to a user-supplied target using a user-supplied payload URL. No backdoor, persistence, credential theft, or unrelated payload delivery was observed. The script's behavior is consistent with a standard SSRF PoC.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareApache Solr
Attack typesSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script cve-2021-27905.py actively sends a crafted HTTP request to a target Solr instance to make it fetch a resource from an attacker-specified URL, which is the definition of exercising the SSRF vulnerability. The README describes it as a Proof of Concept and provides exploitation instructions.

cve-2021-27905.py:1cve-2021-27905.py:50README.md:35README.md:54

Requirements

  • Target Apache Solr instance (version < 8.8.2) must be reachable over the network.cve-2021-27905.py:21
  • Attacker must supply a target URL and an SSRF payload URL.cve-2021-27905.py:21-22

Observed behavior

  • Parses command-line arguments for target, payload, and optional core name.cve-2021-27905.py:15-27
  • If no core name is provided, fetches the list of cores from /solr/admin/cores and selects the first one.cve-2021-27905.py:37-41
  • Constructs a URL targeting the replication handler with the attacker-controlled masterUrl parameter.cve-2021-27905.py:35cve-2021-27905.py:43
  • Sends an HTTP GET request to the constructed URL to trigger the SSRF.cve-2021-27905.py:50
  • Reports success or failure based on the HTTP response status code.cve-2021-27905.py:51-54
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the expected behavior for a CVE-2021-27905 PoC and does not indicate a backdoor.cve-2021-27905.py:35cve-2021-27905.py:50
Network Request
Payload withheldThe script makes a single HTTP GET request to the constructed target URL. No data exfiltration or secondary requests to attacker-controlled infrastructure are hardcoded.cve-2021-27905.py:50
Review boundaries

What the analysis did not establish

  • Evidence includes a non-text media file (poc.gif) that was not analyzed.
  • The lab setup directory and Docker Compose file are not included in the selected text evidence.
  • One non-text media file (attachments/poc.gif, 4483719 bytes) was flagged as metadata-only and not analyzed for steganographic or embedded payloads.
  • One text file (lab/docker-compose.yml) was omitted from the packet and not reviewed.
  • The review does not assess the safety of executing the PoC against unauthorized systems.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.