kimtangker
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubkimtangker/CVE-2024-46256
Repository PoCStars: 0Created 2025-10-14ExploitCVE-2024-462569 files
Analysis
Technical assessment
A Python script that authenticates to Nginx Proxy Manager 2.11.3 and exploits CVE-2024-46256, a command injection vulnerability in the Let's Encrypt certificate request, to achieve remote code execution by downloading and executing a reverse shell payload.
Backdoor review
No backdoor observed in reviewed code
The PoC script (poc_cve_2024_46256_Tool.py) is a straightforward exploit for CVE-2024-46256. It authenticates to Nginx Proxy Manager, sends a command injection payload via the Let's Encrypt certificate API, and offers version checking, vulnerability verification, and reverse shell execution. All actions are directly related to the claimed vulnerability and are operator-initiated. No concealed, deceptive, or unrelated harmful behavior is present.
Classification basis and observed behavior
Classification basis
The script contains a function execute_rce that constructs a command injection payload and sends it to the vulnerable endpoint, and functions vulncheck and exploit that use this to download and execute a reverse shell, which constitutes exploitation code.
poc_cve_2024_46256_Tool.py:53-69poc_cve_2024_46256_Tool.py:175-202Requirements
- Valid credentials for the Nginx Proxy Manager web interface are required to obtain an API token.
poc_cve_2024_46256_Tool.py:37-50 - An attacker-controlled HTTP server must be running to serve a reverse shell payload named 'rev'.
poc_cve_2024_46256_Tool.py:175-182
Observed behavior
- Prompts the user for target URL, credentials, and attacker IP/port, then authenticates to obtain a Bearer token.
poc_cve_2024_46256_Tool.py:37-50poc_cve_2024_46256_Tool.py:220-231 - Sends a crafted JSON payload to /api/nginx/certificates with a domain name containing shell metacharacters to inject an arbitrary command.
poc_cve_2024_46256_Tool.py:53-69 - Downloads a reverse shell binary from the attacker's server to /tmp/rev and makes it executable via injected curl and chmod commands.
poc_cve_2024_46256_Tool.py:175-190 - Executes the downloaded reverse shell payload on the target upon user confirmation.
poc_cve_2024_46256_Tool.py:193-202
Behaviors behind the backdoor verdict
Observables
- Command Injection Payload
- Payload withheldThe script constructs a command injection payload in the domain_names field to achieve RCE, consistent with the CVE description.
poc_cve_2024_46256_Tool.py:55 - Reverse Shell Execution
- Payload withheldThe exploit function prompts the operator to start a listener and then executes a pre-staged reverse shell binary, which is standard post-exploitation behavior for an RCE PoC.
poc_cve_2024_46256_Tool.py:193-202 - Logging
- Payload withheldThe script logs actions (login, RCE commands, version check, exit) to a local file, which is a benign operational log and does not exfiltrate data.
poc_cve_2024_46256_Tool.py:14-20
What the analysis did not establish
- Evidence includes only two text files (README.md and poc_cve_2024_46256_Tool.py) out of nine total files; seven files are omitted and not analyzed.
- The reverse shell payload 'rev' is not included in the evidence, so its exact behavior cannot be confirmed.
- Seven files in the repository were omitted from text analysis; their content is unknown.
- The review is based solely on the supplied text evidence and does not include dynamic analysis or inspection of binary files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkimtangker/CVE-2025-24893
Repository PoCStars: 0Created 2025-10-14ExploitCVE-2025-2489310 files
Analysis
Technical assessment
Python script that performs version detection, vulnerability validation, and interactive remote command execution against XWiki instances vulnerable to CVE-2025-24893 via SolrSearch template injection.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a Python script that exploits CVE-2025-24893 (XWiki SolrSearch RCE) by sending a crafted HTTP request to execute arbitrary commands on a vulnerable target. The script performs version detection, vulnerability validation, and command execution via the documented template injection vector. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm was observed in the reviewed text files.
Classification basis and observed behavior
Classification basis
The script constructs and sends a malicious HTTP request containing a Groovy code injection payload that executes an arbitrary OS command (`command.execute().text`) and returns the result, which constitutes active exploitation, not just detection.
xwiki_exploit_module.py:218xwiki_exploit_module.py:207-247Requirements
- Target must be running a vulnerable XWiki version (5.3-milestone-2 to 15.10.10).
xwiki_exploit_module.py:160-168 - Target must expose the SolrSearch endpoint without authentication.
xwiki_exploit_module.py:218
Observed behavior
- Sends an HTTP GET request to the SolrSearch endpoint with a crafted payload that injects Groovy code to execute an arbitrary OS command and returns the output.
xwiki_exploit_module.py:218-224 - Extracts the command output from the XML/RSS response by searching for a specific pattern and stripping HTML tags.
xwiki_exploit_module.py:268-298 - Provides an interactive command loop that repeatedly executes user-supplied OS commands on the target until 'exit' is entered.
xwiki_exploit_module.py:249-266
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThe payload matches the CVE-2025-24893 description: it uses the SolrSearch endpoint with a Groovy template injection to execute an attacker-supplied command.
xwiki_exploit_module.py:218 - Local Logging
- Payload withheldThe script writes a local log file recording actions, URLs, and results. This is a local operational log, not a covert exfiltration channel.
xwiki_exploit_module.py:30xwiki_exploit_module.py:44-47
What the analysis did not establish
- Only two of ten repository files were provided as text; the remaining eight files (including docker-compose.yml and other potential artifacts) were omitted.
- The evidence was not executed; classification is based solely on static analysis of the provided source code.
- Only 2 of 10 files in the repository were provided as text evidence; 8 files were omitted. The review cannot assess content in those omitted files.
- Binary content, if any, was not analyzed per the evidence envelope policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.