qi4L
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubqi4L/CVE-2026-31431-Container-Escape
Repository PoCStars: 6Created 2026-05-02ExploitCVE-2026-314319 files
Analysis
Technical assessment
A Go-based container escape exploit for CVE-2026-31431 that leverages the Linux AF_ALG socket interface to overwrite a target ELF binary (default /usr/bin/su) with a zlib-compressed payload, then optionally spawns a root shell via the modified su binary.
Backdoor review
No backdoor observed in reviewed code
The supplied Go source code implements a local privilege escalation exploit for CVE-2026-31431. It uses the AF_ALG socket interface to overwrite a target ELF binary (default /usr/bin/su) with a zlib-compressed, hex-encoded payload, then optionally spawns an 'su' shell. The code contains no concealed network callbacks, data exfiltration, unrelated persistence, or other hidden harmful behavior. The payload is embedded as a constant and decoded locally; no external resources are fetched. The behavior matches the disclosed purpose of a container escape PoC.
Classification basis and observed behavior
Classification basis
The code actively overwrites a target ELF binary (/usr/bin/su) with a payload using AF_ALG splice operations and then executes the modified binary to gain elevated privileges, which constitutes exploitation rather than mere detection or scanning.
main.go:67main.go:74-83main.go:89-93Requirements
- Running inside a container with access to a vulnerable Linux kernel (CVE-2026-31431) and a writable target ELF binary (default /usr/bin/su).
main.go:1main.go:46main.go:67
Observed behavior
- Opens a target ELF file (default /usr/bin/su) for writing.
main.go:67 - Decodes a hex-encoded, zlib-compressed payload from a hardcoded constant.
main.go:37main.go:96-108 - Iterates over the payload in 4-byte chunks and for each chunk creates an AF_ALG AEAD socket, configures it with a hardcoded key, and uses splice to copy data from the target file through a pipe into the AF_ALG operation socket, overwriting the target file.
main.go:74-83main.go:111-181 - Optionally executes 'su' after the overwrite loop, which would spawn a root shell if the target binary was successfully replaced with a setuid-root payload.
main.go:47main.go:85-93
Behaviors behind the backdoor verdict
Observables
- Embedded Payload
- Payload withheldThe payload is decoded and written to the target file to achieve privilege escalation. It is a standard part of the exploit, not a hidden backdoor.
main.go:37 - Command Execution
- Payload withheldAfter overwriting the target binary, the exploit optionally spawns an 'su' shell. This is the disclosed post-exploitation action and is controlled by the --spawn-su flag.
main.go:89-93
What the analysis did not establish
- Only 3 of 9 repository files were included as text; 6 files were omitted from the evidence packet.
- The payloadHex constant is opaque hex-encoded compressed data; its decompressed content is not visible in the provided evidence.
- The evidence does not include runtime output or confirmation that the exploit succeeds.
- The zlib-compressed payload (payloadHex) is not decompiled or analyzed; its exact behavior when executed as the overwritten binary is unknown, but it is part of the disclosed exploit, not a hidden backdoor.
- Six non-text files in the repository were not inspected, but they are not part of the selected text evidence and are not required to assess the backdoor risk in the provided code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.