AzureADTrent
Source-scoped identity with 7 associated PoCs and 9 linked vulnerabilities.
Exploit catalog results
Showing 7 PoCs on this page
GitHubAzureADTrent/CVE-2026-52824
Repository PoCStars: 0Created 2026-08-04WriteupCVE-2026-528241 file
Analysis
Technical assessment
A technical writeup for CVE-2026-52824 detailing how a hardcoded APP_SECRET in Kimai Docker images allows forging login links. It includes a PHP code snippet demonstrating the forgery logic but the artifact itself is a README.md document providing analysis, detection, and remediation guidance.
Backdoor review
No backdoor observed in reviewed code
The artifact is a single README.md file documenting CVE-2026-52824. It contains a proof-of-concept PHP script that demonstrates forging a login link for a known-vulnerable Kimai instance. The script uses a hardcoded default secret to compute a valid HMAC and constructs a URL. No backdoor, deceptive payload, or concealed executable behavior targeting the reviewer is present. The PoC is transparently described and serves only to illustrate the vulnerability.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing a technical analysis of CVE-2026-52824, including root cause, proof-of-concept code snippet, detection commands, and remediation steps. It does not function as a standalone exploit or scanner; it is a documentation writeup.
README.md:1-118Requirements
- Target Kimai instance uses the default APP_SECRET 'change_this_to_something_unique'
README.md:21-25 - Attacker knows or guesses a valid username and user ID
README.md:79-81
Observed behavior
- Describes forging a login link by computing an HMAC with the known secret and user ID
README.md:42-67 - Explains that a successful forged request returns a 302 redirect and sets a KIMAI_REMEMBER cookie
README.md:69
Behaviors behind the backdoor verdict
Observables
- Proof Of Concept Code
- Payload withheldDemonstrates the CVE-2026-52824 vulnerability by forging a login link. The code is presented as a static example and does not perform any hidden or harmful action against the reviewer.
README.md:42-67
What the analysis did not establish
- Only one file (README.md) is provided; no other repository files were inspected.
- The artifact is a writeup, not executable code; classification is based on its stated purpose and content.
- Only the README.md file was reviewed; no other files were present in the evidence packet.
- The analysis scope confirms no binary files were inspected, but none were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubAzureADTrent/CVE-2025-58434-59528
Repository PoCStars: 4Created 2026-04-12ExploitCVE-2025-58434CVE-2025-595282 files
Analysis
Technical assessment
A Python exploit chain targeting Flowise <= 3.0.5. It chains CVE-2025-58434 (unauthenticated password reset token disclosure) to achieve account takeover, then uses the obtained API key to trigger CVE-2025-59528 (authenticated remote code execution via CustomMCP node JS injection) to execute arbitrary OS commands or spawn a reverse shell.
Backdoor review
No backdoor observed in reviewed code
The artifact is a Python exploit script and README for CVE-2025-58434 and CVE-2025-59528. The script performs the documented exploit chain: it leaks a password reset token, resets a password, prompts the user for an API key, and then triggers RCE via a CustomMCP node. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit functionality was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, executable Python script (flowise_chain.py) that actively exploits two vulnerabilities: it sends crafted HTTP requests to leak a password reset token, resets the password, and then injects JavaScript code via the Function() constructor to execute arbitrary OS commands or spawn a reverse shell. The README explicitly describes it as an 'Exploit chain' and provides usage examples for full ATO and RCE.
README.md:3flowise_chain.py:1-259Requirements
- Target Flowise instance <= 3.0.5 with exposed API
flowise_chain.py:8 - Valid email address of a Flowise user (for full ATO chain)
flowise_chain.py:164-165 - Python 3.8+ with requests library
README.md:21-22
Observed behavior
- Sends unauthenticated POST to /api/v1/account/forgot-password to extract a password reset tempToken from the API response
flowise_chain.py:58-71 - Uses the leaked tempToken to reset the target account's password via /api/v1/account/reset-password
flowise_chain.py:74-83 - Instructs the operator to manually log in to the web UI to retrieve the API key, then optionally collects attacker IP/port for a reverse shell
flowise_chain.py:86-120 - Constructs a JavaScript payload that uses process.mainModule.require('child_process').execSync() to execute an OS command
flowise_chain.py:136-142 - Sends the JS payload inside the mcpServerConfig field to /api/v1/node-load-method/customMCP with the Bearer API key, triggering remote code execution
flowise_chain.py:128-153 - Optionally builds and delivers a mkfifo-based reverse shell payload
flowise_chain.py:123-125
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented purpose of the artifact and matches the CVE descriptions. No hidden or unrelated actions are performed.
flowise_chain.py:58-71flowise_chain.py:74-83flowise_chain.py:128-153 - Reverse Shell Command
- Payload withheldThis is a standard mkfifo reverse shell payload, consistent with the stated RCE exploit. It is only executed against the target specified by the user.
flowise_chain.py:123-125 - User Interaction
- Payload withheldThis is explained as a workaround for a Flowise 3.0.5 quirk. It does not exfiltrate data or perform actions without user consent.
flowise_chain.py:86-120
What the analysis did not establish
- Evidence is limited to the supplied source code and README; no runtime output, network traffic, or target interaction was observed.
- The exploit requires manual operator interaction to retrieve the API key from the web UI after password reset, as noted in the script comments.
- Only the two text files (README.md and flowise_chain.py) were provided; no binary or other files were present in the artifact.
- The review does not assess the safety or legality of using the exploit against systems without authorization.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubAzureADTrent/CVE-2025-4517-POC
Repository PoCStars: 9Created 2026-02-15ExploitCVE-2025-45173 files
Analysis
Technical assessment
A Python script that creates a malicious tar archive exploiting CVE-2025-4517 to write arbitrary content to /etc/sudoers, and a README describing its usage for privilege escalation.
Backdoor review
No backdoor observed in reviewed code
The PoC is a Python script that exploits CVE-2025-4517 to escalate privileges by writing to /etc/sudoers. It constructs a malicious tar archive using symlinks and hardlinks, deploys it, and triggers extraction via a vulnerable script. All behavior is consistent with the stated exploit goal; no concealed backdoor, unrelated payload, or deceptive operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script (CVE-2025-4517-POC.py) that programmatically constructs a malicious tar archive and executes it to gain root privileges by modifying /etc/sudoers. This is code intended to exercise a vulnerability, meeting the definition of an exploit.
CVE-2025-4517-POC.py:1-203README.md:1-4Requirements
- User access with sudo permissions for a vulnerable script that extracts tar archives using tarfile with filter='data'
README.md:65-66 - Write access to the directory where the malicious tar archive is deployed
README.md:66 - Python 3.8.0 through 3.13.1 installed on the target system
CVE-2025-4517-POC.py:6
Observed behavior
- Creates a tar archive containing a deep nested directory structure, symlink chains, and a hardlink designed to bypass the tarfile data filter and write to /etc/sudoers
CVE-2025-4517-POC.py:23-86 - Copies the malicious tar archive to a target backup directory and executes a vulnerable restore script via sudo to trigger extraction
CVE-2025-4517-POC.py:88-128 - Verifies the exploit by checking if the current user's entry with NOPASSWD: ALL was added to /etc/sudoers
CVE-2025-4517-POC.py:130-153 - Offers to spawn a root shell using sudo /bin/bash after successful exploitation
CVE-2025-4517-POC.py:155-161
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal, documented exploit behavior for CVE-2025-4517 and does not constitute a backdoor.
CVE-2025-4517-POC.py:23-86CVE-2025-4517-POC.py:88-128 - Privilege Escalation
- Payload withheldThis is the intended outcome of the privilege escalation exploit, not a hidden backdoor.
CVE-2025-4517-POC.py:36CVE-2025-4517-POC.py:155-161
What the analysis did not establish
- One file (LICENSE) was omitted from the packet; its content is not available for analysis.
- The evidence includes a README that states the exploit was tested and confirmed working, but the analysis does not verify this claim.
- One file (LICENSE) was omitted from the text evidence; its content is not reviewed.
- Binary content was not analyzed; the artifact contains no identified binary files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubAzureADTrent/CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation
Repository PoCStars: 1Created 2026-02-09WriteupCVE-2025-6018CVE-2025-60191 file
Analysis
Technical assessment
A README file providing a brief, high-level narrative on chaining CVE-2025-6018 and CVE-2025-6019 to achieve root privileges. It references external tools and scripts but contains no exploit or scanner code itself.
Backdoor review
Backdoor review undetermined
The artifact is a README.md file providing instructions to exploit CVE-2025-6018 and CVE-2025-6019. It directs the operator to download and execute two external scripts from different GitHub repositories. The behavior of these external scripts is not included in the reviewed evidence, making it impossible to determine if they contain backdoor or deceptive payloads.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file containing only a textual description of an attack chain. It does not include any executable code, scripts, or scanner logic. It references external repositories for the actual exploit tools, making it a technical writeup rather than an exploit or scanner.
README.md:1-20Requirements
- An unprivileged local user session (e.g., via SSH) to exploit CVE-2025-6018.
README.md:7 - Access to an external tool from ibrahmsql/CVE-2025-6018 to obtain an initial shell.
README.md:4-5 - Ability to run a script locally as sudo to generate a malicious XFS image.
README.md:9-10 - Ability to transfer files (the script and XFS image) to the victim machine.
README.md:12
Observed behavior
- The artifact describes a multi-step attack: first, use an external tool to gain a shell as an unprivileged user via CVE-2025-6018.
README.md:4-7 - Second, generate a malicious XFS image containing a SUID-root shell using an external script for CVE-2025-6019.
README.md:9-10 - Third, transfer the script and image to the victim, set the PATH, and run the script to trigger the libblockdev/udisks vulnerability, resulting in root access.
README.md:12-19
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldExternal script referenced for CVE-2025-6018 exploitation. The URL appears truncated in the evidence.
README.md:5 - Url
- Payload withheldExternal script referenced for CVE-2025-6019 exploitation.
README.md:10
What the analysis did not establish
- The artifact is a single README file with no executable code; the actual exploit and scanner code are hosted in external repositories not included in this evidence.
- The analysis is based solely on the supplied text; the referenced external tools were not inspected or verified.
- The evidence consists solely of a README.md file with instructions. The actual exploit scripts referenced via external URLs are not included in the reviewed material.
- The URL for the CVE-2025-6018 script appears to be truncated in the provided text, preventing full identification of the resource.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubAzureADTrent/CVE-2025-2304_POC
Repository PoCStars: 1Created 2026-02-01WriteupCVE-2025-23041 file
Analysis
Technical assessment
A README file describing a privilege escalation vulnerability in Camaleon CMS. It explains how an authenticated user can inject a 'role' parameter into a password change request to gain administrator privileges, but it does not contain any executable code.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a README.md file describing a manual privilege escalation technique for CVE-2025-2304 in Camaleon CMS. The instructions involve intercepting a password change request and adding a role parameter. No executable code, scripts, or concealed payloads are present in the supplied evidence.
Classification basis and observed behavior
Classification basis
The artifact is a README file that provides a technical description of a vulnerability and manual steps to exploit it, but it does not contain any executable code, script, or automated scanner. It is a substantive technical analysis without exploit or scanner code.
README.md:1-34Requirements
- A user account on the target Camaleon CMS that can access /admin.
README.md:10
Observed behavior
- Instructs the user to intercept a password change request and modify the payload to include a 'role' parameter set to 'admin'.
README.md:13-23
Behaviors behind the backdoor verdict
Observables
- Manual Exploit Instruction
- Payload withheldThis is the claimed PoC behavior for CVE-2025-2304 and does not constitute a backdoor or deceptive payload.
README.md:21-23
What the analysis did not establish
- The artifact consists solely of a README.md file with no executable code, scripts, or configuration files present in the selected text evidence.
- Only the README.md file was provided; no other repository files were inspected. The artifact may contain additional files not included in this evidence packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.