Smarttfoxx

Classification basis

The artifact contains complete, compilable C source code that actively exploits CVE-2026-31431 to overwrite a setuid binary's page cache with shellcode and then execute it to gain root privileges. The README explicitly describes it as a 'Local privilege escalation exploit' and provides usage instructions showing a root shell.

Requirements

• Local unprivileged user access to a vulnerable Linux kernel with AF_ALG support and a setuid-root payload withheld binary.exploit.c:163-172

Observed behavior

• Opens payload withheld, parses its ELF headers to resolve the entry point virtual address to a file offset.exploit.c:168-193
• Creates an AF_ALG socket and binds to the 'authencesn(hmac(sha256),cbc(aes))' AEAD algorithm with a zero key.exploit.c:195-227
• For each 4-byte chunk of the shellcode, sends AAD containing the shellcode bytes via sendmsg with MSG_MORE, splices 32 bytes from the target file's page cache as the authentication tag, and triggers decryption via recv to write controlled bytes into the page cache.exploit.c:88-161exploit.c:241-255
• Executes the corrupted payload withheld binary, which runs the injected shellcode (setuid(0); execve("/bin/sh")) to spawn a root shell.exploit.c:261-264exploit.c:52-67

Observables

Exploit Technique

Payload withheldThe exploit uses the CVE-2026-31431 vulnerability to escalate privileges locally. This is the stated purpose of the PoC.exploit.c:88-161exploit.c:163-265README.md:8-14

Shellcode

Payload withheldThe shellcode embedded in the exploit performs only privilege escalation to a root shell, consistent with the PoC's stated goal.exploit.c:52-67README.md:18-32

Target Binary

Payload withheldThe exploit targets a setuid-root binary to achieve privilege escalation, which is the documented attack vector for this CVE.exploit.c:42exploit.c:168exploit.c:262

Classification basis

The artifact is a technical writeup. It contains a substantive analysis of the vulnerability, including vulnerable code logic and exploitation steps, but does not include any executable exploit or scanner code. The author explicitly states that no code is provided.

Requirements

• Local, low-privileged access to a system with the vulnerable pstrip64.sys driver installed.README.md:2

Observed behavior

• The document describes the vulnerability in the IOCTL handler 0x80002008, which maps arbitrary physical memory into the calling process's address space.README.md:6
• The document outlines a proof-of-concept exploitation method that scans physical memory for _EPROCESS structures and overwrites a process token to gain SYSTEM privileges.README.md:26-30
• The author explicitly states that no exploit code will be made publicly available.README.md:26

Observables

Vulnerability Description

Payload withheldThe README documents a legitimate vulnerability, not a backdoor. The described exploitation technique (token stealing) is a standard privilege escalation method.README.md:1-8

Code Snippet

Payload withheldSnippet illustrates the vulnerable driver logic. It is presented as documentation, not as executable instructions for the reader.README.md:11-17

Author Statement

Payload withheldConfirms that no executable PoC is included in the repository, reducing the risk of hidden malicious payloads.README.md:26

Classification basis

The artifact is a textual description of a vulnerability with no executable code. It does not contain an exploit or scanner script, only a writeup with embedded images.

Requirements

• Access to the Clients module to insert payload into Name or Surname fields.README.md:2
• Ability to save client details to the database.README.md:8
• Ability to trigger the XSS by clicking the 'Statement' button.README.md:8

Observed behavior

• The README describes a stored XSS vulnerability where a script payload is saved in the Name or Surname fields and executed when the 'Statement' button is clicked.README.md:2README.md:8

Observables

Vulnerability Description

Payload withheldThe README describes a CVE and includes a sample XSS payload (<script>alert("xss 1")</script>) as part of the vulnerability explanation, not as an instruction for the reviewer.README.md:1-12

Classification basis

The artifact is a README.md file that describes a vulnerability, provides example SQL injection payloads, and shows screenshots of the application's behavior. It does not contain any executable code to exploit or scan for the vulnerability; it is a technical analysis and demonstration of the issue.

Requirements

• Access to the Search function of the Orders page in Abacre Retail Point of Sale 14.0.0.396.README.md:2

Observed behavior

• The writeup describes injecting SQL payloads into the Search function to confirm the existence of a 'Client' table and enumerate the number of records.README.md:8-11README.md:24-27

Observables

SQL Payload

Payload withheldExample payload demonstrating the described blind SQL injection in the target application's Search function.README.md:11

SQL Payload

Payload withheldExample payload demonstrating boolean-based blind SQL injection to confirm table row count.README.md:27

Classification basis

The artifact is a README file that describes a vulnerability, provides vulnerable code snippets, and explains the attack vector. It does not contain any executable exploit code or scanner code; it is purely a technical writeup.

Requirements

• Attacker must be able to send commands to the Discord botREADME.md:4

Observed behavior

• The gif() and png() functions build file paths using unsanitized user input for the 'name' parameterREADME.md:2
• The name parameter is directly interpolated into the file path without validation or sanitizationREADME.md:33
• Example payloads show directory traversal sequences to access files outside the intended directoryREADME.md:40-48

Observables

Vulnerability Documentation

Payload withheldThe README describes a path traversal vulnerability in gif() and png() functions, including code snippets and example payloads.README.md:1-52

Classification basis

The artifact is a README file that provides a technical description of the vulnerability, references debugger output images, and lists CWE classifications. It contains no executable code, scripts, or instructions that constitute an exploit or scanner. It is a substantive technical analysis without exploit or scanner code, fitting the definition of a writeup.

Requirements

• Attacker must be able to attach a debugger to the Abacre Restaurant POS process or analyze its memory dump during an activation attempt.README.md:4

Observed behavior

• The application leaves valid device-bound license keys in process memory during an activation attempt.README.md:4
• The keys can be obtained by attaching the process to a debugger and analyzing the process/memory dump.README.md:4
• The obtained keys can be used to activate the software on the same machine without purchasing.README.md:4

Observables

Vulnerability Documentation

Payload withheldThe README.md describes a vulnerability in a third-party application, not a backdoor or malicious payload targeting the reviewer.README.md:1-4

External Image Reference

Payload withheldThe README references external images hosted on GitHub as evidence of the vulnerability. These are not executable and were not analyzed, but their presence does not indicate a backdoor.README.md:8

Classification basis

The artifact is a README file that provides a textual description of the CVE-2025-60791 vulnerability and its exploitation method, but it does not contain any executable code, scripts, or tools to perform the exploitation or scanning. It is a technical writeup.

Requirements

• Attach a debugger or analyze a process/memory dump of Easywork Enterprise after a failed activation attempt.README.md:4

Observed behavior

• The artifact describes that valid device-bound license keys are left in cleartext in process memory after a failed activation attempt.README.md:4
• The artifact includes two screenshots, but their content is not provided as text evidence.README.md:6-8

Observables

Vulnerability Description

Payload withheldThe README describes the vulnerability and its impact, consistent with the associated CVE record.README.md:2-4

Embedded Image

Payload withheldImage likely shows a screenshot related to the vulnerability; no executable content is present in the text.README.md:6

Embedded Image

Payload withheldImage likely shows a screenshot related to the vulnerability; no executable content is present in the text.README.md:8