tc4dy
Source-scoped identity with 15 associated PoCs and 15 linked vulnerabilities.
Exploit catalog results
Showing 15 PoCs on this page
GitHubtc4dy/CVE-2026-64638-PoC-Exploit
Repository PoCStars: 1Created 2026-08-08ExploitCVE-2026-646387 files
Analysis
Technical assessment
The artifact is a full exploitation toolkit for CVE-2026-64638, a pre-auth reflected XSS in WordPress. The primary script, exploit.py, implements a multi-stage attack chain: XSS injection, Application Password capture, malicious plugin upload for RCE, reverse shell, persistence, privilege escalation, and C2 beaconing. It is designed to actively compromise a target, not merely detect the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a disclosed exploit for CVE-2026-64638, a WordPress XSS-to-RCE chain. The code implements the described attack: XSS injection, Application Password capture, plugin upload, and post-exploitation actions (reverse shell, C2, privilege escalation, etc.). All behavior is consistent with the documented exploit functionality. No concealed or materially misrepresented behavior targeting the operator or an unrelated system was found.
Classification basis and observed behavior
Classification basis
The primary artifact, exploit.py, is explicitly designed to exploit CVE-2026-64638. It implements a full attack chain that goes beyond detection to actively compromise a target by capturing credentials, uploading a webshell, and providing post-exploitation capabilities like reverse shells and persistence. The README.md describes it as a 'Full exploitation toolkit' for 'Red teams / authorized pentesters'.
README.md:44exploit.py:1224-1268Requirements
- A vulnerable WordPress instance (versions 4.7.0 through 7.0.2) with the Application Password feature enabled.
README.md:17 - The attacker must be able to host a malicious JavaScript payload on a server reachable by the victim's browser.
exploit.py:741-859 - The attack requires social engineering or tricking a logged-in WordPress administrator into visiting a malicious page or clicking a crafted link.
README.md:22
Observed behavior
- Checks if the target WordPress site is vulnerable by sending a crafted XSS payload to the login form and checking for its reflection.
exploit.py:725-734 - Starts a local HTTP server to host a JavaScript payload that, when executed in the victim's browser, automatically generates an Application Password via the WordPress REST API and exfiltrates it to the attacker.
exploit.py:741-859 - Generates an HTML exploit page that auto-submits the XSS payload to the target's wp-login.php.
exploit.py:872-888 - Uses the captured Application Password to authenticate to the WordPress admin panel and upload a malicious plugin containing a webshell.
exploit.py:1059-1094 - Provides an interactive shell for executing system commands on the compromised server via the uploaded webshell.
exploit.py:1119-1130 - Includes modules for reverse shell, persistence (cron, systemd, SSH), privilege escalation, memory forensics, database dumping, and C2 beaconing.
exploit.py:1132-1145exploit.py:1147-1178exploit.py:1209-1217exploit.py:1219-1222exploit.py:938-999exploit.py:82-208
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe exploit.py file implements the full attack chain described in the README, including credential capture via a local HTTP server and subsequent authenticated actions.
exploit.py:861-870exploit.py:1059-1094exploit.py:1224-1268 - Local Http Server
- Payload withheldThe exploit starts a local HTTP server to serve the XSS payload and receive captured credentials. This is a standard technique for reflected XSS exploitation and is disclosed in the README.
exploit.py:741-859 - C2 Communication
- Payload withheldThe C2Manager class implements beaconing to a user-supplied C2 server. The README documents this feature, and it is only activated when the operator provides --c2-type and --c2-server arguments.
exploit.py:82-208README.md:59 - Post Exploitation Modules
- Payload withheldThese modules are part of the disclosed exploit toolkit and are only executed when the operator enables them via command-line flags or interactive commands.
exploit.py:210-293exploit.py:295-372exploit.py:938-999exploit.py:1011-1057exploit.py:1147-1178
What the analysis did not establish
- The evidence packet does not include the content of safecheck.py, which is described as a non-intrusive scanner. Only exploit.py, README.md, and requirements.txt were provided as selected text.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its actual functionality or reliability cannot be verified.
- The evidence packet reports one non-text media file (likely the image 64638.png) and three unclassified files that were not included in the selected text, so their content is unknown.
- The safecheck.py file was not included in the selected text evidence and was not reviewed.
- Binary and non-text media files (e.g., 64638.png) were not analyzed.
- The review is limited to static analysis of the provided text; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-58048-PoC-Exploit
Repository PoCStars: 5Created 2026-08-06ExploitCVE-2026-580487 files
Analysis
Technical assessment
The artifact is a full weaponized exploit toolkit for CVE-2026-58048, a critical SQL injection vulnerability in cPanel. The primary file, exploit.py, contains code to authenticate to cPanel, manipulate SQL modes, inject arbitrary SQL via the database rename functionality, and execute post-exploitation actions including reverse shells, file read/write, UDF command execution, and user creation. A secondary scanner script (safecheck.py) is described in the README but not included in the supplied evidence.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, an exploit script (exploit.py), and a requirements file for CVE-2026-58048. The exploit script implements the documented SQL injection attack against cPanel and provides post-exploitation actions (reverse shell, persistence, file read/write, etc.) that are consistent with the stated purpose of a weaponized PoC for authorized testing. No concealed, unrelated, or operator-directed harmful behavior beyond the advertised exploit was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The file exploit.py contains complete, functional code that actively exploits CVE-2026-58048 by injecting malicious SQL via the database rename functionality to gain root-level MySQL access and perform post-exploitation actions such as reverse shells, file I/O, and user creation. This goes beyond detection or scanning; it is a weaponized exploit toolkit.
exploit.py:296-314exploit.py:329-355exploit.py:449-453Requirements
- Valid cPanel account credentials (username/password) on the target server.
README.md:21exploit.py:471-481 - Target cPanel server must be running a vulnerable version (11.x before 11.138.1.6).
README.md:17exploit.py:185-188 - MySQL port (default 3306) must be reachable from the attacker's machine.
exploit.py:223-225
Observed behavior
- Authenticates to cPanel using provided credentials via UAPI endpoint /execute/Version/get_version.
exploit.py:259-275 - Connects directly to the MySQL server and sets the session SQL mode to ANSI_QUOTES to enable injection.
exploit.py:276-285 - Creates a temporary database, then renames it with a payload containing injected SQL (e.g., GRANT ALL PRIVILEGES) via the vulnerable /execute/Mysql/rename_database endpoint.
exploit.py:286-314 - Executes post-exploitation actions: creates admin MySQL users, reads/writes server files via LOAD_FILE/INTO OUTFILE, executes OS commands via UDF, changes root password, and creates new cPanel users for persistence.
exploit.py:329-355 - Provides an interactive shell for ongoing SQL execution, file operations, and user management.
exploit.py:386-448 - Supports mass scanning of multiple targets from a file using multi-threading.
exploit.py:595-643
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldAll observed behavior is consistent with the advertised CVE-2026-58048 exploit toolkit and does not indicate a backdoor or deceptive payload.
exploit.py:1-692
What the analysis did not establish
- The safecheck.py scanner script is described in the README but its source code is not included in the supplied evidence packets.
- The evidence includes only three text files (README.md, exploit.py, requirements.txt); four other files (including one non-text media file) are omitted.
- The analysis is based solely on static code review; the code was not executed, and its actual effectiveness or reliability is not verified.
- One binary file (58048.png) was flagged as metadata-only and not analyzed; it could contain hidden content.
- Three text files (total 22,095 bytes) were present in the repository but not included in the selected text evidence; their content is unknown.
- The review is limited to static analysis of the provided text; no dynamic execution or behavioral analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-61511-PoC-Exploit
Repository PoCStars: 4Created 2026-07-29ExploitCVE-2026-615117 files
Analysis
Technical assessment
The artifact is a full-featured exploit toolkit for CVE-2026-61511, a pre-auth RCE vulnerability in vBulletin. It includes payload generation for reverse shells, webshells, persistence, and various post-exploitation modules, along with a mass scanner.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and a Python exploit script (exploit.py) for CVE-2026-61511, a vBulletin eval injection vulnerability. The script is a comprehensive post-exploitation toolkit that performs actions consistent with the stated vulnerability: it generates PHP payloads using phpfuck-style encoding to achieve remote code execution, and provides modules for reverse shells, webshells, persistence, credential dumping, and other offensive operations. All observed behavior is directed at the declared target (a vulnerable vBulletin instance) and is explicitly documented in the README. No concealed backdoor, deceptive payload, or unrelated operator-directed harm (e.g., credential theft from the PoC runner, unrelated remote access, or persistence on the analyst's machine) was found.
Classification basis and observed behavior
Classification basis
The primary artifact, exploit.py, contains code that generates and delivers malicious payloads to achieve remote code execution, including reverse shells, webshells, and persistence mechanisms. This is clearly intended to exercise the vulnerability, not merely detect it.
exploit.py:111-115exploit.py:147-163exploit.py:173-187Requirements
- Target running vulnerable vBulletin (5.x through 5.7.5 or 6.x through 6.2.1)
README.md:18 - Network access to the target's AJAX endpoints
exploit.py:84-103
Observed behavior
- Generates PHPFuck-encoded payloads to bypass WAF filters and inject arbitrary PHP code via eval()
exploit.py:81-109 - Sends crafted POST requests to multiple vulnerable AJAX endpoints to achieve unauthenticated RCE
exploit.py:562-583 - Provides post-exploitation modules including reverse shell, webshell installation, persistence, credential dumping, and firewall disabling
exploit.py:627-910 - Includes a mass scanner for detecting vulnerable targets across multiple hosts
exploit.py:1006-1158
Behaviors behind the backdoor verdict
Observables
- Payload Generation
- Payload withheldThe script constructs payloads that exploit the described CVE-2026-61511 vulnerability to execute arbitrary PHP on the target server. This is the expected behavior of a PoC exploit for this CVE.
exploit.py:81-109exploit.py:111-115 - Post Exploitation Modules
- Payload withheldThe script includes many post-exploitation features (reverse shell, webshell installation, cron/systemd persistence, credential dumping, firewall disabling, etc.). These are all directed at the target vBulletin server and are consistent with a weaponized exploit toolkit. They do not target the analyst's machine.
exploit.py:627-633exploit.py:721-733exploit.py:744-751exploit.py:815-826exploit.py:828-835 - Network Listener
- Payload withheldThe reverse shell listener binds to all interfaces on the attacker's machine, which is standard for receiving reverse shell connections. It does not establish any outbound connection to a third party.
exploit.py:635-643
What the analysis did not establish
- The evidence packet does not include the safecheck.py file, which is described in the README as a non-intrusive scanner. Only exploit.py and README.md are provided.
- The analysis is based solely on static code review; the code was not executed, and its effectiveness is not verified.
- The evidence envelope reports 7 total files in the repository; only 3 text files were included in the review. 4 files (including 1 non-text media file) were omitted. The omitted files are not described as containing executable code, but their content was not reviewed.
- The analysis is based solely on static review of the provided text; no dynamic execution or behavioral analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-53921-PoC-Exploit
Repository PoCStars: 6Created 2026-07-28ExploitCVE-2026-539217 files
Analysis
Technical assessment
The artifact is a full weaponized exploit for CVE-2026-53921, a stack buffer overflow in OpenWrt's odhcpd DHCPv6 daemon. It includes exploit.py, which crafts malicious DHCPv6 packets with shellcode to achieve remote code execution as root, and a README.md describing the vulnerability and usage.
Backdoor review
No backdoor observed in reviewed code
The repository contains a disclosed exploit for CVE-2026-53921, a stack buffer overflow in OpenWrt's odhcpd. The exploit.py script sends crafted DHCPv6 packets to trigger the overflow and deliver shellcode (reverse or bind shell) to the target. It also includes post-exploitation features (persistence, log clearing) that act on the target. All behavior is consistent with the documented exploit functionality; no concealed or misrepresented actions targeting the operator or unrelated systems were found.
Classification basis and observed behavior
Classification basis
The artifact contains exploit.py, which is explicitly described as a 'Full weaponized exploit' in the README. The code constructs and sends malicious DHCPv6 packets with shellcode to trigger a stack buffer overflow and achieve remote code execution, which is the definition of an exploit.
README.md:178-181exploit.py:292-318exploit.py:515-567Requirements
- Attacker must have IPv6 connectivity to the target and the target must have UDP port 547 (DHCPv6) open.
README.md:88-97 - The target must be running a vulnerable version of odhcpd (before commit e432dd6) or OpenWrt (< 24.10.8 or < 25.12.5).
README.md:143-150 - The exploit script requires root privileges to craft raw IPv6 packets.
exploit.py:31-32
Observed behavior
- Sends crafted DHCPv6 Request packets containing 5 or more IA_NA options or 22 or more IA_PD options to overflow a 512-byte stack buffer in odhcpd.
exploit.py:292-318exploit.py:320-347 - Embeds architecture-specific shellcode (MIPS reverse/bind, ARM reverse/bind) into the overflow payload to execute arbitrary commands on the target.
exploit.py:79-128exploit.py:130-179exploit.py:181-233exploit.py:235-248 - Starts a listener to receive a reverse shell or connect to a bind shell after exploitation.
exploit.py:411-468 - Supports post-exploitation actions including installing a cron backdoor for persistence and clearing system logs.
exploit.py:470-504
Behaviors behind the backdoor verdict
Observables
- Shellcode
- Payload withheldThe shellcode is the disclosed payload for the CVE-2026-53921 exploit, intended to execute on the target device.
exploit.py:79-248 - Post-Exploitation
- Payload withheldThese functions (install_persistence, clear_logs) act on the exploited target via the established shell, consistent with the documented exploit features.
exploit.py:470-504
What the analysis did not establish
- The evidence packet does not include the verifier.py script mentioned in the README, only its description.
- The evidence packet does not include the binary file (53921.png) or other non-text files from the repository.
- The CVE record for CVE-2026-53921 was absent from the acquired CVEList V5 dataset.
- The CVE-2026-53921 record was absent from the acquired CVEList V5, so the exploit's claimed CVE association could not be independently verified.
- One non-text media file (53921.png) and three unclassified files were not inspected; they are unlikely to contain executable backdoor logic.
- The ARM shellcode appears to be placeholder/non-functional (e.g., arm_reverse_shell contains repetitive register moves without syscall instructions), but this does not constitute a backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-54121-PoC-Exploit
Repository PoCStars: 27Created 2026-07-25ExploitCVE-2026-541218 files
Analysis
Technical assessment
The artifact is a Python-based exploit framework for CVE-2026-54121, an elevation of privilege vulnerability in Active Directory Certificate Services. It includes code to set up rogue SMB and LDAP servers, request a certificate from a CA with manipulated target parameters, and perform PKINIT authentication to extract a Domain Controller's NT hash, enabling domain takeover.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python exploit for CVE-2026-54121, an AD CS privilege escalation vulnerability. The code implements the disclosed attack: creating a computer account, setting up rogue SMB/LDAP servers to intercept CA verification traffic, requesting a certificate with a manipulated target, and extracting NT hashes via PKINIT. No concealed or materially misrepresented behavior was found. The code's actions are consistent with the documented exploit, and all network connections are directed to operator-supplied targets. The Shodan integration is optional and requires an operator-provided API key. No evidence of data exfiltration to a third party, unrelated payload execution, or hidden persistence was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by setting up rogue infrastructure, manipulating certificate request parameters, and extracting credentials. It is not limited to detection; the --exploit flag triggers the full attack chain, and the --detect flag only marks targets as vulnerable without exploitation.
exploit.py:1282exploit.py:1358-1363README.md:75-76Requirements
- Low-privileged domain user credentials (username and password or NTLM hash).
README.md:45exploit.py:1488-1490 - Network access to a Domain Controller and a Certificate Authority server.
README.md:65-66exploit.py:1486-1487 - Ability to run the exploit as root to bind to privileged ports (445, 389).
exploit.py:1178-1180
Observed behavior
- Creates a temporary computer account in the domain via LDAP or SAMR.
exploit.py:1057-1113 - Starts rogue SMB and LDAP servers on the attacker's machine to impersonate a Domain Controller.
exploit.py:1344-1349 - Sends a certificate request to the CA with a manipulated 'cdc' attribute pointing to the attacker's IP, causing the CA to query the rogue server.
exploit.py:997-1006 - Uses the issued certificate to perform PKINIT authentication and extract the target Domain Controller's NT hash from the PAC.
exploit.py:882-980
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe tool can optionally load targets from Shodan if the operator provides an API key. This is a disclosed feature for target discovery.
exploit.py:1209-1228 - Network Connection
- Payload withheldAll exploit traffic (LDAP, SMB, RPC, Kerberos) is directed to the Domain Controller IP and CA IP provided by the operator via command-line arguments.
exploit.py:1258-1261exploit.py:1021-1027 - File Creation
- Payload withheldThe tool creates a log file, a certificate file (.pfx), and a Kerberos credential cache file (.ccache) locally as part of the exploit process. These are standard outputs for this type of tool.
exploit.py:1191exploit.py:1361-1362exploit.py:911-912
What the analysis did not establish
- The evidence includes only the README.md, exploit.py, and requirements.txt files. Other files in the repository (e.g., PowerShell script, stealthcert.py) are not provided, so the full scope of the toolkit cannot be assessed.
- The artifact's binary files (e.g., 54121.png) were not analyzed, but they are unlikely to affect the classification.
- The code was not executed; the analysis is based solely on static review of the provided source code.
- The repository contains 5 other files (including 1 non-text media file) that were not included in the analysis packet. Their content is unknown, but the primary exploit logic is in the provided files.
- The analysis is static; no dynamic execution was performed to confirm runtime behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-60206-PoC-Exploit
Repository PoCStars: 4Created 2026-07-24ExploitCVE-2026-602068 files
Analysis
Technical assessment
The artifact is an exploit framework for CVE-2026-60206, an Oracle WebLogic SAML authentication bypass. It contains Python and Bash scripts that craft and send malicious SAML assertions to gain administrative access, steal session cookies, and verify successful exploitation.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a Python exploit script, a Bash exploit script, and a Bash verifier script, all targeting CVE-2026-60206 (Oracle WebLogic SAML authentication bypass). The code crafts and sends malicious SAML assertions to a target WebLogic server to achieve authentication bypass and session hijacking. No concealed backdoor, unrelated payload, credential exfiltration to an external party, or persistence mechanism was observed. The behavior is consistent with a proof-of-concept exploit for the stated vulnerability.
Classification basis and observed behavior
Classification basis
The code actively constructs and delivers exploit payloads (malicious SAML assertions) to a target server to achieve authentication bypass and gain administrative access. It includes logic to verify successful exploitation by checking for admin console access. This is the primary stated purpose of the artifact, as described in the README and implemented in exploit.py and exploit.sh.
README.md:2exploit.py:463-484exploit.py:486-496Requirements
- Network access to a target Oracle WebLogic Server instance.
exploit.py:336-337 - Python 3.6+ with requests and urllib3, or Bash with curl.
README.md:128-130
Observed behavior
- Crafts and base64-encodes malicious SAML responses, including unsigned assertions, XML Signature Wrapping (XSW) variants, and NameID comment injection.
exploit.py:181-309 - Sends crafted SAMLResponse to discovered SAML ACS endpoints (e.g., /saml2/sp/acs) via HTTP POST.
exploit.py:463-484 - Checks for authentication success by inspecting response for JSESSIONID cookies, redirects to console, or presence of admin dashboard indicators.
exploit.py:438-461 - Verifies obtained administrative access by accessing the WebLogic console with the stolen JSESSIONID cookie.
exploit.py:486-496 - Supports mass scanning of multiple targets with threading, output to JSON/CSV/JSONL, and optional Shodan integration.
exploit.py:498-507
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit behavior for CVE-2026-60206. It is not a backdoor.
exploit.py:179-230exploit.py:463-484exploit.sh:183-239exploit.sh:537-625 - Exploit Behavior
- Payload withheldThis is session hijacking, a direct consequence of the authentication bypass exploit. It does not exfiltrate the cookie to an external server.
exploit.py:392-401exploit.py:438-461exploit.py:486-496exploit.sh:375-406exploit.sh:627-652 - Exploit Behavior
- Payload withheldThe cookie is saved locally for later use by the operator. This is not exfiltration.
exploit.py:109-115exploit.py:621-622exploit.sh:167-172exploit.sh:743 - Network Behavior
- Payload withheldAll network activity is directed at the target specified by the operator. There is no phone-home or C2 communication.
exploit.py:336-390exploit.sh:408-454 - File Operation
- Payload withheldThese are expected logging and output operations for a security tool. No system file modification or persistence is performed.
exploit.py:510-527exploit.py:688-710
What the analysis did not establish
- Evidence includes only selected text files (README.md, exploit.py, exploit.sh, verifier_poc.sh). Three additional text files and one non-text file (60206.png) are present in the repository but not included in the analysis.
- The artifact's code was not executed; classification is based solely on static analysis of the provided source code.
- The evidence packet includes 4 text files out of 8 total files in the repository. The remaining 4 files (1 non-text media file and 3 unclassified files) were not provided and were not analyzed. Their content is unknown.
- Binary files were flagged as metadata-only and not analyzed. The non-text media file (60206.png) could contain steganographic data, but this is speculative and not supported by the provided evidence.
- The review is limited to static analysis of the provided source code. No dynamic execution or network traffic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-6875-PoC-Exploit
Repository PoCStars: 3Created 2026-07-21ExploitCVE-2026-68757 files
Analysis
Technical assessment
The artifact is a full weaponized exploit framework for CVE-2026-6875, a pre-auth RCE in ServiceNow AI Platform. It chains JavaScript injection with a sandbox escape to execute arbitrary system commands, and includes post-exploitation modules for privilege escalation, persistence, lateral movement, and credential dumping.
Backdoor review
No backdoor observed in reviewed code
The repository contains a disclosed exploit framework and verifier for CVE-2026-6875, a ServiceNow pre-auth RCE. The Python code in exploit.py implements the described JavaScript injection, sandbox escape, and post-exploitation modules (shell, privesc, persistence, lateral movement, etc.) against a target ServiceNow instance. All behavior is consistent with the advertised exploit functionality and operates against the operator-supplied target. No concealed payloads, unauthorized data exfiltration, or deceptive local execution against the operator were found.
Classification basis and observed behavior
Classification basis
The artifact's primary purpose is to exploit CVE-2026-6875 for remote code execution. The code constructs and delivers a JavaScript injection payload that escapes the sandbox and executes arbitrary system commands via java.lang.Runtime.exec(). It includes an interactive shell, reverse shell, webshell upload, and multiple post-exploitation modules. Although a --detect flag exists, the overwhelming majority of the codebase is dedicated to exploitation, not mere detection.
exploit.py:92-107exploit.py:109-133exploit.py:272-313exploit.py:451-515README.md:1-2README.md:70-72Requirements
- Target must be a vulnerable, self-hosted ServiceNow AI Platform instance with the assessment_thanks.do endpoint exposed.
README.md:48README.md:63exploit.py:190 - Attacker must have network access to the target's HTTPS port (default 443).
exploit.py:190exploit.py:653
Observed behavior
- Sends a POST request to /assessment_thanks.do with a crafted sysparm_assessable_type parameter containing a JavaScript injection payload.
exploit.py:190-208exploit.py:92-107 - The injected JavaScript escapes the ServiceNow script sandbox using a gadget chain involving DiscoveryFunctions, AbstractAjaxProcessor, and Class.create, then executes arbitrary Java code via java.lang.Runtime.exec().
exploit.py:92-107exploit.py:109-133README.md:256-273 - Provides an interactive shell for executing arbitrary OS commands, uploading webshells, downloading files, and triggering post-exploitation modules (privesc, persistence, lateral movement, credential dumping, clean tracks).
exploit.py:451-515exploit.py:315-330exploit.py:411-440 - Includes a detection mode (--detect) that checks for vulnerability by sending a benign echo command and inspecting the response, but the primary purpose is exploitation.
exploit.py:247-270README.md:84
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldLink to another exploit repository by the same author, listed in README.md references.
README.md:346 - Url
- Payload withheldLink to another exploit repository by the same author, listed in README.md references.
README.md:349 - Url
- Payload withheldLink to another exploit repository by the same author, listed in README.md references.
README.md:352 - Url
- Payload withheldLink to another exploit repository by the same author, listed in README.md references.
README.md:355
What the analysis did not establish
- The evidence includes only three text files (README.md, exploit.py, requirements.txt) out of seven total files; four files (including one non-text media file) are omitted, so the analysis may not cover all repository contents.
- The verifier.py file mentioned in the README is not included in the supplied evidence, so its behavior cannot be confirmed.
- The analysis is based solely on static code review; the code was not executed, and its actual effectiveness or safety is not verified.
- The repository contains 4 files not included in the text evidence (1 non-text media file, 3 unclassified files), which were not analyzed. Their content could theoretically contain concealed behavior, but no positive evidence suggests this.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-15409-15410-Framework
Repository PoCStars: 5Created 2026-07-17ExploitCVE-2026-154096 files
Analysis
Technical assessment
The artifact is a Python-based exploit framework targeting CVE-2026-15409 (SSRF) and CVE-2026-15410 (privilege escalation) in SonicWall SMA1000 appliances. It implements a full attack chain: SSRF via a WebSocket proxy to reach internal Erlang nodes, Erlang RPC authentication using a hardcoded cookie, remote code execution via os:cmd/1, and an optional root privilege escalation. It also includes an SSRF detection module.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-15409 and CVE-2026-15410 targeting SonicWall SMA1000 appliances. The code implements an SSRF-to-Erlang-RCE chain and a privilege escalation module, consistent with the stated vulnerabilities. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text files (README.md, exploit.py, requirements.txt).
Classification basis and observed behavior
Classification basis
The primary artifact (exploit.py) contains code that actively exploits the vulnerability by establishing a WebSocket tunnel, authenticating to an Erlang node, and executing arbitrary commands. The README describes it as a 'full weaponized exploit' and 'Exploit Framework'. While a detection function exists, the core purpose is exploitation.
README.md:21README.md:49-51exploit.py:635-639Requirements
- Target must be a vulnerable SonicWall SMA1000 appliance (SMA 6210, SMA 7210, SMA 8200v) with the wsproxy endpoint exposed.
README.md:31README.md:44 - The attacker must have network connectivity to the target's HTTPS port (default 443).
exploit.py:553-554
Observed behavior
- Establishes a WebSocket connection to the target's wsproxy endpoint, tunneling to internal Erlang distribution services on port 1050.
exploit.py:550-554README.md:34-35 - Performs an Erlang distribution handshake and authenticates using a hardcoded default cookie (payload withheld).
exploit.py:76exploit.py:556-598 - Executes arbitrary OS commands on the target via Erlang RPC calls to os:cmd/1.
exploit.py:635-639README.md:37 - Optionally escalates privileges to root by writing a script to /var/tmp/ and triggering the AMC remove_hotfix XML-RPC endpoint with a path traversal.
exploit.py:654-683README.md:38 - Includes an SSRF detection function that probes multiple endpoints and parameters to identify the vulnerability without exploitation.
exploit.py:290-382
Behaviors behind the backdoor verdict
Observables
- Hardcoded Credential
- Payload withheldDefault Erlang cookie used for authentication to the target Erlang node, as described in the vulnerability documentation.
exploit.py:76 - Command Execution
- Payload withheldThe exploit executes arbitrary OS commands on the target through the Erlang distribution protocol, which is the intended exploit behavior.
exploit.py:635-639 - Privilege Escalation
- Payload withheldThe exploit writes a script to /var/tmp/ and triggers it through an XML-RPC call with path traversal, matching the described privesc technique.
exploit.py:654-683 - Network Connection
- Payload withheldThe exploit establishes a WebSocket connection to the target's wsproxy endpoint to reach internal Erlang services, as described in the vulnerability chain.
exploit.py:550-554exploit.py:664-665
What the analysis did not establish
- material evidence limitation
- One non-text media file (doublepoc.png, 1,476,928 bytes) was not analyzed.
- Two unclassified files (22,474 bytes total) were not analyzed.
- Two text files (5 total) were omitted from the packet due to size constraints and were not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-57821-PoC-Exploit
Repository PoCStars: 3Created 2026-07-16ExploitCVE-2026-578219 files
Analysis
Technical assessment
The artifact contains a Python script (exploit.py) that performs time-based and error-based blind SQL injection to extract database version, user, database name, and table names from a vulnerable Apache Fineract instance. It also includes a separate verification script (cve.py) that checks for vulnerability without extracting data.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a Python-based PoC for CVE-2026-57821, an Apache Fineract SQL injection vulnerability. The code performs vulnerability verification and data extraction via time-based or error-based SQL injection against a user-supplied target. No concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor functionality was observed. The scripts operate solely within the scope of the described CVE exploitation.
Classification basis and observed behavior
Classification basis
The primary artifact 'exploit.py' is designed to exercise the SQL injection vulnerability to extract data from the database, which is the definition of an exploit. The README explicitly describes it as a 'Comprehensive Security Analyzer' that 'Fully exercise[s] the vulnerability to extract database information'.
README.md:105-110exploit.py:299-313Requirements
- Valid credentials for the target Apache Fineract instance
exploit.py:43-45 - Target Apache Fineract version <= 1.14.0
README.md:24
Observed behavior
- Sends crafted SQL subqueries in the 'orderBy' parameter to the /api/v1/offices endpoint
exploit.py:99 - Detects database type by measuring response delays or parsing error messages
exploit.py:117-154 - Extracts database information (version, user, database name, table names) using binary search over character codes
exploit.py:246-297
Behaviors behind the backdoor verdict
Observables
- Network Target
- Payload withheldDefault target URL for the PoC; user-configurable. All HTTP requests are directed to this endpoint with the supplied credentials.
exploit.py:42Educational-Verifier-PoCs/cve.py:7 - Credential
- Payload withheldDefault hardcoded credentials used for authentication against the target Fineract API. These are standard demo credentials for Apache Fineract.
exploit.py:43-44Educational-Verifier-PoCs/cve.py:8-9 - Sql Injection Payload
- Payload withheldExample time-based blind SQL injection payload used to verify the vulnerability. This is the documented attack vector for CVE-2026-57821.
README.md:38Educational-Verifier-PoCs/cve.py:57
What the analysis did not establish
- The evidence includes 4 text files with complete content, but 4 additional text files and 1 non-text file are omitted from the packet. The analysis is based solely on the provided text content.
- One non-text media file (cvepicture.png) and four unclassified files were present in the repository but not included in the text evidence; their content was not analyzed.
- The analysis scope excludes binary or non-text files, which could theoretically contain concealed payloads, though no such files were flagged as executable.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-14762-PoC-Exploit
Repository PoCStars: 2Created 2026-07-07ExploitCVE-2026-147627 files
Analysis
Technical assessment
A Python-based time-based blind SQL injection exploit targeting CVE-2026-14762 in code-projects Hotel and Tourism Reservation 1.0. The primary artifact (exploit.py) implements binary-search character extraction to dump databases, read files via LOAD_FILE, and write a PHP webshell via INTO OUTFILE for remote code execution. A secondary script (basic_exploit.py) provides a simple vulnerability check.
Backdoor review
No backdoor observed in reviewed code
The supplied text files (README.MD, basic_exploit.py, exploit.py, requirements.txt) implement a time-based blind SQL injection exploit for CVE-2026-14762. All code is consistent with the stated purpose: sending crafted HTTP requests to a vulnerable /admin/rooms.php endpoint, measuring response delays to infer database content, and offering optional file read/write and interactive SQL shell features. No concealed executable behavior, unrelated remote access, persistence mechanisms, credential theft, or deceptive payloads were observed. The exploit operates only against a user-supplied target and does not perform any hidden actions against the operator.
Classification basis and observed behavior
Classification basis
The primary file exploit.py contains complete code to exploit the SQL injection vulnerability, including database exfiltration, file read, and webshell write for remote code execution. The README explicitly describes it as an exploit achieving RCE. The basic_exploit.py is a simple vulnerability scanner, but the dominant artifact is the full exploit.
exploit.py:1-446README.MD:8-10basic_exploit.py:1-28Requirements
- Target running code-projects Hotel and Tourism Reservation 1.0 with accessible /admin/rooms.php endpoint
exploit.py:58README.MD:9 - MySQL database with SLEEP() function available and vulnerable to time-based blind SQL injection
exploit.py:134README.MD:96
Observed behavior
- Sends HTTP GET requests to /admin/rooms.php with a crafted delete parameter containing a time-based blind SQL injection payload
exploit.py:133-136basic_exploit.py:12-13 - Uses binary search over ASCII range to extract string values from database responses by measuring SLEEP() delays
exploit.py:154-180 - Enumerates database name, tables, and columns via information_schema queries
exploit.py:182-217 - Dumps table data row by row and column by column using time-based extraction
exploit.py:219-240 - Reads server files using LOAD_FILE() SQL function
exploit.py:242-250 - Writes a PHP webshell to the webroot using SELECT ... INTO OUTFILE for remote code execution
exploit.py:252-267 - Provides an interactive SQL shell for manual time-based query execution
exploit.py:269-285
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe core exploit logic uses conditional SLEEP() injection to extract data character by character, matching the CVE description.
exploit.py:133-142exploit.py:154-180 - File Write Capability
- Payload withheldThe write_webshell method writes a PHP one-liner to the target server's webroot. This is a documented feature of the exploit, not a hidden backdoor against the operator.
exploit.py:252-267 - Network Communication
- Payload withheldAll network requests are directed to the target URL provided by the operator. No hardcoded external callbacks, C2 servers, or data exfiltration to third parties are present.
exploit.py:102-131basic_exploit.py:11-20
What the analysis did not establish
- Evidence includes only selected text files; one non-text media file (cve_exploit.png) and two text files without content are not provided, but the core exploit code is complete.
- The artifact is not executed; classification is based on static analysis of the provided source code and documentation.
- Three files from the repository snapshot were not included in the text evidence: one non-text media file (cve_exploit.png, 396649 bytes) and two unclassified files (1755 bytes total). Their content was not reviewed. The inventory metadata does not suggest they contain executable code, but their absence is a material limitation.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-41091-PoC-Exploit
Repository PoCStars: 3Created 2026-06-20ExploitCVE-2026-410917 files
Analysis
Technical assessment
The artifact is a C++ exploit for CVE-2026-41091, a local privilege escalation vulnerability in Microsoft Defender. It uses NTFS junctions, oplocks, and the Cloud Files API to trick Defender into writing a payload to System32, then activates a COM service to execute it as SYSTEM.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of source code for a CVE-2026-41091 local privilege escalation proof-of-concept exploit targeting Microsoft Defender. The code implements a documented exploit chain using oplocks, NTFS junctions, and Cloud Files API to copy a file to System32 and activate a COM service. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The artifact's behavior is consistent with its stated purpose as a PoC exploit.
Classification basis and observed behavior
Classification basis
The code is designed to exercise the vulnerability by performing privilege escalation: it writes a file to a protected system directory and executes it with SYSTEM privileges. The readme explicitly states it is a 'full working Proof of Concept (PoC) exploit' for local privilege escalation.
readme.md:17full_poc.cpp:401-405full_poc.cpp:407-411Requirements
- Low-privileged local user account on a vulnerable Windows system with Microsoft Defender enabled.
readme.md:17 - Microsoft Malware Protection Engine version < 1.1.26040.8.
readme.md:52
Observed behavior
- Creates a working directory and writes a reversed EICAR test string to a bait file to trigger Microsoft Defender scanning.
full_poc.cpp:247-270 - Monitors for Volume Shadow Copy (VSS) snapshot creation by querying the \Device object directory.
full_poc.cpp:47-132 - Creates batch oplocks on the bait file to control timing and gain exclusive access.
full_poc.cpp:134-159 - Renames the working directory and creates an NTFS junction pointing to C:\Windows\System32.
full_poc.cpp:172-207 - Copies the bait file to System32 as TieringEngineService.exe.
full_poc.cpp:272-274 - Activates the Storage Tiers Management COM service to execute the dropped payload as SYSTEM.
full_poc.cpp:276-286
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe full_poc.cpp implements a multi-step exploit chain to achieve local privilege escalation by tricking Defender into writing a file to System32 and then activating a COM service as SYSTEM.
full_poc.cpp:303-414 - Target File
- Payload withheldThe exploit copies a bait file to this system path, which is consistent with the documented privilege escalation technique.
full_poc.cpp:300 - Com Object
- Payload withheldThe exploit activates this COM object to achieve SYSTEM-level code execution, a known technique for local privilege escalation.
full_poc.cpp:32full_poc.cpp:276-286
What the analysis did not establish
- Evidence includes only selected text files; 3 files (including 1 non-text media file) are omitted.
- The artifact's binary files were not inspected; the analysis is based solely on the provided source code and readme.
- Binary file solarflareploit.png (2,461,660 bytes) was not analyzed; it could contain hidden data.
- Two text files (total 2,193 bytes) were omitted from the evidence packet and not reviewed.
- The review is limited to static source code analysis; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-24061-PoC-Exploit
Repository PoCStars: 6Created 2026-06-06ExploitCVE-2026-240617 files
Analysis
Technical assessment
The artifact is a full exploit for CVE-2026-24061, a critical authentication bypass in GNU inetutils-telnetd. It provides Python and Bash scripts that connect to a target telnetd service, inject a crafted NEW_ENVIRON payload with payload withheld to bypass authentication, and establish an interactive root shell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and three exploit scripts (Python and Bash) for CVE-2026-24061, a telnetd authentication bypass. The scripts implement the documented exploit by injecting a crafted NEW_ENVIRON payload with payload withheld to bypass authentication and obtain a shell. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The code performs only the advertised exploitation and interactive shell access.
Classification basis and observed behavior
Classification basis
The code actively connects to a target, sends a malicious payload to bypass authentication, and provides an interactive shell. This is the definition of an exploit, not a scanner or writeup. The README explicitly labels it as an exploit and describes its exploitation features.
README.md:13exploit.py:62-69basic_exploit.sh:75Requirements
- Network access to a vulnerable telnetd service (port 23 by default).
exploit.py:130-132
Observed behavior
- Connects to a target telnetd service on a specified port.
exploit.py:130-132basic_exploit.sh:57 - Sends a crafted telnet NEW_ENVIRON subnegotiation payload containing payload withheld (or a user-specified username) to bypass authentication.
exploit.py:62-69basic_exploit.sh:75 - Provides an interactive shell session to the attacker after successful exploitation.
exploit.py:194-198basic_exploit.sh:87-102 - Supports mass exploitation of multiple targets from a file with configurable multi-threading.
exploit.py:228-270exploit.sh:259-327
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThe core exploit payload matches the CVE description and is used to bypass authentication.
exploit.py:63-69exploit.sh:69-71basic_exploit.sh:75 - Network Connection
- Payload withheldScripts connect to the specified target on the telnet port to deliver the exploit and provide an interactive shell.
exploit.py:130-132exploit.sh:173basic_exploit.sh:57
What the analysis did not establish
- Evidence includes only selected text files; two text files and one non-text file are omitted, but the provided files contain the complete exploit logic.
- Three files (test.png, requirements.txt, LICENSE) were not provided as text and were not analyzed; their content is unknown.
- The review is limited to static analysis of the supplied source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-0073-PoC-Exploit
Repository PoCStars: 9Created 2026-05-13ExploitCVE-2026-00737 files
Analysis
Technical assessment
The artifact is a Python exploit for CVE-2026-0073, an authentication bypass in Android's ADB Wireless Debugging. It generates an EC or Ed25519 client certificate, establishes a TLS 1.3 connection to the target, performs the ADB authentication handshake, and opens an interactive shell or executes a single command.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and two Python scripts (basic_exploit.py, exploit.py) that implement a proof-of-concept for CVE-2026-0073, an ADB wireless debugging authentication bypass. The code performs TLS connection, certificate generation, ADB protocol handshake, and shell interaction—all consistent with the claimed exploit. No concealed executable behavior, unrelated payloads, credential theft, persistence mechanisms, or operator-directed harm were observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The code implements a full exploitation chain: it generates a malicious certificate, connects to the target, bypasses ADB authentication, and opens a remote shell. The README explicitly labels it as a 'PoC' and 'Exploit', and the code contains functions to execute commands and provide interactive shell access.
README.md:1-2exploit.py:298-319exploit.py:351-376Requirements
- Target device must have Wireless Debugging enabled and be reachable on the network.
exploit.py:1 - Attacker must know or discover the target's Wireless Debugging port.
exploit.py:248-260
Observed behavior
- Generates a self-signed EC P-256 or Ed25519 certificate with CN=adb.
exploit.py:137-157 - Connects to the target via TCP and performs a TLS 1.3 handshake using the generated certificate.
exploit.py:273-296 - Sends an ADB CNXN message and signs the received AUTH token to bypass authentication.
exploit.py:298-319 - Opens an ADB shell stream and either executes a single command or provides an interactive shell.
exploit.py:321-376 - Includes a network scanner to discover Wireless Debugging ports on a subnet.
exploit.py:409-434
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldAll code behavior aligns with the described CVE-2026-0073 authentication bypass exploit; no unrelated or concealed actions detected.
exploit.py:273-296exploit.py:298-319exploit.py:321-331exploit.py:333-349exploit.py:351-376 - Network Activity
- Payload withheldNetwork activity is limited to the target ADB service, consistent with the exploit's purpose.
exploit.py:276-278exploit.py:288 - File System Activity
- Payload withheldTemporary file usage is standard for loading certificates into SSL context; output file write is user-controlled and documented.
exploit.py:284-287exploit.py:294-296exploit.py:399-401
What the analysis did not establish
- Evidence does not include the binary image file (0073.png) or two other text files omitted from the packet.
- The artifact's actual effectiveness against patched or unpatched devices is not verified.
- One non-text media file (0073.png) was flagged as metadata-only and not analyzed for steganographic or embedded payloads.
- Two unclassified files (totaling 1696 bytes) were present in the repository but not included in the text evidence; their content is unknown.
- The review is limited to static analysis of the supplied text; no dynamic execution or behavioral analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-29000-PoC-Exploit
Repository PoCStars: 3Created 2026-05-12ExploitCVE-2026-290005 files
Analysis
Technical assessment
A Python script that exploits CVE-2026-29000 by fetching a server's RSA public key from a JWKS endpoint, forging a JWT with algorithm 'none', encrypting it into a JWE, and using it to bypass authentication and exfiltrate data from protected endpoints.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a Python exploit script, and a requirements file for CVE-2026-29000. The exploit performs the documented authentication bypass: it fetches a JWKS public key, forges an alg:none JWT, wraps it in a JWE, and uses it to access protected endpoints. No concealed executable behavior, unrelated payload, persistence mechanism, or operator-directed harm was observed. The script's actions are consistent with the stated exploit purpose.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, multi-stage script that actively exploits the vulnerability by forging authentication tokens and using them to access protected resources and exfiltrate data. It does not merely detect or report the vulnerability.
exploit.py:44exploit.py:365-387README.md:12Requirements
- Target server must expose a JWKS endpoint with an RSA public key.
exploit.py:118-147 - Target server must accept JWE tokens and be vulnerable to the 'alg: none' bypass.
exploit.py:206-208
Observed behavior
- Discovers the JWKS endpoint by probing a list of common paths.
exploit.py:118-147 - Extracts the RSA public key from the JWKS response and converts it to PEM format.
exploit.py:149-191 - Creates a JWT with algorithm 'none' and admin claims (sub: admin, role: ROLE_ADMIN, admin: true).
exploit.py:193-208 - Encrypts the forged JWT into a JWE using the server's public key.
exploit.py:210-220 - Sends the forged JWE as a Bearer token to protected endpoints to test authentication bypass.
exploit.py:274-303 - Enumerates sensitive API paths using the forged token and saves leaked responses to a file.
exploit.py:305-343 - Maintains session persistence by periodically pinging an endpoint with the forged token.
exploit.py:345-358
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldAll observed actions directly implement the described CVE-2026-29000 authentication bypass and information gathering.
exploit.py:118-147exploit.py:149-191exploit.py:193-208exploit.py:210-220exploit.py:274-303exploit.py:305-343exploit.py:345-358
What the analysis did not establish
- Two files (total 5) were omitted from the text evidence; their content is unknown.
- The evidence was not executed; classification is based solely on static analysis of the provided source code.
- Two unclassified files totaling 1595 bytes were present in the artifact but not analyzed; their content is unknown.
- Only the selected commit snapshot was reviewed; other branches or tags were not examined.
- The review is limited to static analysis of the provided text; no dynamic execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtc4dy/CVE-2026-41940-PoC-Exploit
Repository PoCStars: 9Created 2026-05-12ExploitCVE-2026-419406 files
Analysis
Technical assessment
The artifact is a Python exploit for CVE-2026-41940, an authentication bypass vulnerability in cPanel/WHM. It performs a multi-stage attack using CRLF injection to hijack sessions, extract account lists, execute commands, and maintain access.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM. The code performs the disclosed exploit steps: CRLF injection, session hijacking, and post-exploitation actions (RCE, reverse shell, file read, password change, user creation) against a user-supplied target. All network requests are directed to the target specified by the operator. No hidden, unrelated, or deceptive behavior was found. The payload is hardcoded and consistent with the described vulnerability. No evidence of data exfiltration to a third party, concealed persistence, or misrepresented functionality was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by sending crafted HTTP requests to bypass authentication, hijack sessions, and execute commands on the target. It is not merely detecting or reporting the vulnerability.
exploit.py:192-242exploit.py:286-308Requirements
- Target must be a cPanel/WHM instance vulnerable to CVE-2026-41940.
README.md:13 - Attacker must have network access to the target's WHM port (default 2087).
exploit.py:67
Observed behavior
- Sends a POST request to /login/?login_only=1 with invalid credentials to obtain a pre-authentication session cookie.
exploit.py:196 - Injects a base64-encoded CRLF payload into the Authorization header to bypass authentication and leak a security token.
exploit.py:39-40exploit.py:223-224 - Uses the hijacked session to extract cPanel account lists via the JSON API.
exploit.py:253-256 - Provides post-exploitation capabilities including command execution, reverse shell, password change, and file reading.
exploit.py:286-308exploit.py:310-324exploit.py:326-338exploit.py:355-367
Behaviors behind the backdoor verdict
Observables
- Hardcoded Payload
- Payload withheldThe CRLF injection payload used in the authentication bypass is hardcoded in exploit.py (line 39) and base64-encoded (line 40). It is consistent with the disclosed CVE-2026-41940 vulnerability.
exploit.py:39-40 - Target Communication
- Payload withheldAll HTTP requests in the exploit are sent to the operator-supplied target URL, constructed from self.scheme, self.host, and self.port (lines 160-175). No requests are made to any other host.
exploit.py:160-175 - Reverse Shell Target
- Payload withheldThe reverse shell command (line 312) connects back to the IP and port provided by the operator via the --reverse-shell argument (lines 491-494). This is a disclosed feature of the exploit.
exploit.py:310-314exploit.py:491-494
What the analysis did not establish
- The evidence includes only the README, exploit script, and requirements file. Other files in the repository (e.g., images, additional scripts) were not provided as text and were not analyzed.
- The analysis is based solely on static code review; the exploit was not executed, and its effectiveness against live targets is not verified.
- One non-text media file (cpanelgg.png, 2,031,707 bytes) was not inspected; it is a PNG image and unlikely to contain executable backdoor code.
- Two unclassified files (2,009 bytes total) were not inspected; their content and potential for harm are unknown.
- Two text files (README.md and requirements.txt) were fully reviewed; no concerns found.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.