Goultarde
Source-scoped identity with 5 associated PoCs and 7 linked vulnerabilities.
Exploit catalog results
Showing 5 PoCs on this page
GitHubGoultarde/CVE-2025-6018_CVE-2025-6019_autopwn
Repository PoCStars: 4Created 2026-02-10ExploitCVE-2025-6018CVE-2025-60195 files
Analysis
Technical assessment
A Python script that automates a local privilege escalation chain (CVE-2025-6018 and CVE-2025-6019) by connecting to a target via SSH, injecting a malicious PAM environment, and exploiting a UDisks2 vulnerability to mount a SUID-root shell image, ultimately providing an interactive root shell.
Backdoor review
No backdoor observed in reviewed code
The provided PoC automates a local privilege escalation chain (CVE-2025-6018 and CVE-2025-6019) against a target host via SSH. All actions are consistent with the disclosed exploit: creating a malicious XFS image with a SUID bash, injecting PAM environment variables, and executing a local script on the target to gain root. No concealed or materially misrepresented behavior harming the operator or an unrelated system was found.
Classification basis and observed behavior
Classification basis
The artifact is a Python script that actively exploits CVE-2025-6018 and CVE-2025-6019 to escalate privileges to root. It performs the full attack chain: creating a malicious SUID binary, injecting PAM environment variables, and triggering a UDisks2 vulnerability to mount the image and spawn a root shell. The README explicitly describes it as a 'full exploit chain' and 'Auto-Pwn'.
CVE-2025-6018_CVE-2025-6019_autopwn.py:70-142README.md:3-8Requirements
- Valid SSH credentials (username and password) for the target system.
CVE-2025-6018_CVE-2025-6019_autopwn.py:87 - Local sudo access on the attacker machine to create the XFS image.
CVE-2025-6018_CVE-2025-6019_autopwn.py:92-98 - The target system must be vulnerable to CVE-2025-6018 (PAM environment injection) and CVE-2025-6019 (UDisks2 privilege escalation).
README.md:3-6
Observed behavior
- Connects to the target system over SSH using provided credentials.
CVE-2025-6018_CVE-2025-6019_autopwn.py:85-87 - Downloads /bin/bash from the target to create a local SUID-root binary.
CVE-2025-6018_CVE-2025-6019_autopwn.py:90 - Creates a local XFS filesystem image containing the SUID-root bash binary.
CVE-2025-6018_CVE-2025-6019_autopwn.py:92-98 - Uploads the malicious XFS image and an exploit script to the target via SFTP.
CVE-2025-6018_CVE-2025-6019_autopwn.py:102-103 - Injects PAM environment variables (XDG_SEAT, XDG_VTNR) into ~/.pam_environment on the target to gain allow_active status.
CVE-2025-6018_CVE-2025-6019_autopwn.py:106-107 - Reconnects to the target to trigger the PAM injection, then executes the uploaded exploit script to mount the malicious image and obtain an interactive root shell.
CVE-2025-6018_CVE-2025-6019_autopwn.py:118-140
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldThis command is executed on the remote target to inject the PAM environment, which is the core of the CVE-2025-6018 exploit.
CVE-2025-6018_CVE-2025-6019_autopwn.py:106 - Command Execution
- Payload withheldThis executes the local 'exploit.sh' script on the target, which is the CVE-2025-6019 exploit to mount the malicious image and gain root.
CVE-2025-6018_CVE-2025-6019_autopwn.py:129 - File Upload
- Payload withheldThe locally crafted XFS image containing the SUID bash is uploaded to the target, a necessary step for the CVE-2025-6019 exploit.
CVE-2025-6018_CVE-2025-6019_autopwn.py:102 - File Upload
- Payload withheldThe local 'exploit.sh' script is uploaded to the target. Its content is not provided in the evidence, but its execution is part of the disclosed exploit chain.
CVE-2025-6018_CVE-2025-6019_autopwn.py:103 - Credential Usage
- Payload withheldThe operator-supplied credentials are used to connect to the target host. No hardcoded or exfiltrated credentials are present.
CVE-2025-6018_CVE-2025-6019_autopwn.py:87
What the analysis did not establish
- The exploit script (exploit.sh) referenced in the Python code is not included in the provided evidence, so the exact UDisks2 exploitation steps cannot be fully analyzed.
- The evidence does not include the two omitted files from the repository, which may contain additional exploit logic or documentation.
- The content of the 'exploit.sh' script is not included in the evidence, so its exact behavior on the target cannot be verified. However, its execution is consistent with the disclosed exploit and no evidence suggests it performs actions beyond the stated LPE.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubGoultarde/CVE-2024-46987
Repository PoCStars: 27Created 2026-02-01ExploitCVE-2024-469872 files
Analysis
Technical assessment
A Python script that authenticates to a Camaleon CMS instance and exploits a path traversal vulnerability in the download_private_file endpoint to read arbitrary files from the server.
Backdoor review
No backdoor observed in reviewed code
The PoC script performs only the advertised authenticated path traversal against Camaleon CMS. It logs in, retrieves a CSRF token, and reads a user-specified file via the vulnerable endpoint. No hidden network calls, persistence mechanisms, credential exfiltration, or unrelated payloads are present.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by authenticating and then sending a crafted request to read arbitrary files, which is the definition of an exploit. It does not merely check for the vulnerability's existence.
CVE-2024-46987.py:53-66README.md:3Requirements
- Requires valid credentials for a Camaleon CMS user account.
CVE-2024-46987.py:11-14README.md:9 - Requires Python 3.x and the 'requests' library.
README.md:19-20
Observed behavior
- Logs into the Camaleon CMS admin panel by fetching a CSRF token and submitting credentials.
CVE-2024-46987.py:24-51 - Constructs a URL with a path traversal sequence (../../../../../../../../../..) prepended to a user-supplied file path and sends a GET request to the vulnerable endpoint.
CVE-2024-46987.py:53-66 - Prints the raw content of the retrieved file to standard output.
CVE-2024-46987.py:61-62
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget URL is supplied by the user via command-line argument; no hardcoded external host.
CVE-2024-46987.py:11-12 - Credential Handling
- Payload withheldCredentials are used only for local authentication to the target CMS; they are not sent to any third party.
CVE-2024-46987.py:38-44 - File Operation
- Payload withheldReads a file from the target server via the LFI endpoint and prints the content to stdout; no local file write or exfiltration to external host.
CVE-2024-46987.py:53-66
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubGoultarde/CVE-2022-42889-text4shell
Repository PoCStars: 0Created 2026-01-02ExploitCVE-2022-428892 files
Analysis
Technical assessment
A Python script that constructs and sends an HTTP request containing a malicious Apache Commons Text interpolation payload (${script:javascript:...}) to trigger remote code execution and establish a reverse shell on a vulnerable target.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python script (text4shll.py) that exploits CVE-2022-42889 (Text4Shell) by sending a crafted HTTP request with a Java payload to trigger a reverse shell. The script's behavior is consistent with a standard public exploit for this vulnerability. No concealed backdoor, unrelated payload, or operator-directed harm was observed in the reviewed text files.
Classification basis and observed behavior
Classification basis
The script actively constructs and delivers a payload designed to execute arbitrary code on a remote system, which is the definition of an exploit. The README explicitly states it is 'designed to exploit the CVE-2022-42889 vulnerability' and 'automates the delivery of a Java-based payload to trigger a reverse shell'.
README.md:5text4shll.py:21-24Requirements
- Target application uses a vulnerable version of Apache Commons Text (1.5 through 1.9) and passes untrusted input to the default interpolator.
README.md:5 - Attacker must have a listener ready to receive the reverse shell connection.
text4shll.py:22-23
Observed behavior
- Constructs a Java payload that uses the 'script' StringLookup to execute a bash reverse shell command.
text4shll.py:21-24 - URL-encodes the payload and sends it as an HTTP GET parameter to the specified target.
text4shll.py:27-43
Behaviors behind the backdoor verdict
Observables
- Reverse Shell Payload
- Payload withheldThe script constructs a Java payload that executes a bash reverse shell to an attacker-controlled host and port. This is the intended exploit behavior for CVE-2022-42889.
text4shll.py:21-24 - Network Connection
- Payload withheldThe script sends an HTTP GET request to the target server with the encoded payload as a query parameter. This is the delivery mechanism for the exploit.
text4shll.py:33-35text4shll.py:43
What the analysis did not establish
- Evidence is limited to the two supplied text files; no network traffic, execution logs, or target environment details are provided.
- The script's effectiveness depends on the target application's specific use of the vulnerable library, which is not verified in the evidence.
- Only the two text files (README.md and text4shll.py) were reviewed; no binary or non-text files were present.
- The review is static and does not confirm the script's behavior at runtime or in a network environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubGoultarde/CVE-2025-55182-React2Shell-Lab
Repository PoCStars: 0Created 2025-12-31ScannerCVE-2025-5518237 files
Analysis
Technical assessment
The artifact is a Nuclei template for CVE-2025-55182 that sends crafted HTTP requests to detect the vulnerability by checking for a calculated arithmetic result in a redirect header, without executing arbitrary commands or extracting a flag.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files describe a CTF challenge environment for CVE-2025-55182. The Dockerfile, README, Nuclei template, and package.json all serve the stated purpose of demonstrating the React2Shell vulnerability. No concealed executable behavior, credential theft, persistence, or unrelated payloads were observed in the supplied evidence.
Classification basis and observed behavior
Classification basis
The primary artifact is a Nuclei template (CVE-2025-55182.yaml) that sends a payload to trigger code execution but only uses it to compute a mathematical expression and checks the response for a specific redirect header. It does not extract data, establish a shell, or deliver a payload beyond the detection check. This is consistent with a scanner that validates vulnerability presence without exploitation.
nuclei-template/CVE-2025-55182.yaml:1-90Requirements
- Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) or Next.js with the App Router.
nuclei-template/CVE-2025-55182.yaml:8-11
Observed behavior
- Sends a multipart/form-data POST request to the root path with a Next-Action header and a JSON payload that triggers unsafe deserialization to execute a mathematical expression via child_process.execSync.
nuclei-template/CVE-2025-55182.yaml:40-60 - The executed command computes the product of two random numbers and embeds the result in a redirect URL.
nuclei-template/CVE-2025-55182.yaml:51 - Matches the response by checking if the x-action-redirect header contains the expected arithmetic result, confirming code execution.
nuclei-template/CVE-2025-55182.yaml:87-90
Behaviors behind the backdoor verdict
Observables
- Vulnerable Versions
- Payload withheldThe package.json pins vulnerable versions matching the CVE description, consistent with a CTF lab.
package.json:11-13 - Exploit Payload
- Payload withheldThe README provides a manual exploit payload that matches the known CVE-2025-55182 exploitation technique.
README.md:76-110 - Ctf Flag
- Payload withheldThe Dockerfile writes a CTF flag to /root/flag.txt, which is typical for a CTF challenge and not a backdoor.
Dockerfile:47-48
What the analysis did not establish
- The repository contains a Dockerfile and README that describe a CTF environment and a manual exploit payload, but the primary evidence file selected for analysis is the Nuclei template. The README references an exploit tool in a 'React2Shell/' directory, but that directory is not included in the selected text files.
- Two binary files (RETEX.pdf and a font) are present but not analyzed; their content is unknown.
- 30 additional text files in the repository are not included in the evidence packet, so their content cannot be assessed.
- Two binary files (RETEX.pdf, Generator-Variable.ttf) were flagged as metadata-only and not analyzed; their content could contain hidden payloads.
- 30 text files in the repository were omitted from the evidence packet and were not reviewed.
- The review is limited to static analysis of the supplied text excerpts; no dynamic execution or behavioral analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.