stefan-500
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubstefan-500/ktor-cve-2023-45612-poc
Repository PoCStars: 1Created 2025-11-07ScannerCVE-2023-4561219 files
Analysis
Technical assessment
The artifact is a proof-of-concept repository for payload withheld, an XXE vulnerability in Ktor. The primary code provided is an XML payload (xxe-demo-file.xml) and a secret file (secret.txt) used to demonstrate the vulnerability. The README describes how to run a vulnerable Ktor server and send the payload using curl, which would read the secret file and display its contents. The artifact does not contain any exploit code that automatically exercises the vulnerability; it provides a payload and instructions for manual testing, functioning as a vulnerability scanner/demonstrator.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a sample secret file, and an XXE payload XML. The README documents a known payload withheld proof-of-concept, describes standard XXE exploitation steps, and provides prevention guidance. The XML payload and secret file are benign demonstration resources. No backdoor, trojan, or deceptive behavior is observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact provides an XML payload and instructions for manually sending it to a vulnerable server to observe the XXE behavior. It does not include any code that automatically sends the request or exploits the vulnerability; it only demonstrates how to check for the vulnerability. This matches the definition of a scanner: code that checks for a vulnerability without exploiting it.
README.md:1README.md:8README.md:40-41README.md:61-63Requirements
- A vulnerable Ktor server (version < 2.3.5) with XML ContentNegotiation enabled must be running.
README.md:8README.md:14 - The attacker must be able to send HTTP POST requests to the server's /xml endpoint.
README.md:40
Observed behavior
- The README instructs the user to send an XML payload containing an external entity reference to a local file (exploit/etc/secret.txt) via curl to the /xml endpoint.
README.md:61-63 - The XML payload defines an external entity 'xxe' pointing to 'exploit/etc/secret.txt' and references it in the document body.
exploit/payloads/xxe-demo-file.xml:1-2 - The expected vulnerable result is that the server console outputs the contents of the secret file.
README.md:65-66
Behaviors behind the backdoor verdict
Observables
- Cve Reference
- Payload withheldThe artifact is a proof-of-concept repository for a known XXE vulnerability in Ktor. The README explicitly states this and links to the CVE.
README.md:1 - Xxe Payload
- Payload withheldThe XML payload is a standard XXE demonstration file that references a local file (exploit/etc/secret.txt) to illustrate the vulnerability. It does not contain any backdoor or malicious logic.
exploit/payloads/xxe-demo-file.xml:1-2 - Sample Secret File
- Payload withheldThe secret.txt file contains placeholder credentials used as a target for the XXE demonstration. It is not a real secret and does not indicate any backdoor behavior.
exploit/etc/secret.txt:1-2
What the analysis did not establish
- The repository contains a binary file (gradle-wrapper.jar) that was not analyzed.
- Only 3 of 19 files were provided as text; the remaining 16 files (including potential source code for the Ktor server) were omitted.
- The evidence does not include the actual Ktor server source code, so the vulnerable configuration cannot be verified.
- One binary file (gradle-wrapper.jar, 45457 bytes) was flagged but not analyzed. It is a standard build tool component, but its contents were not inspected.
- 13 unclassified files and 2 non-text media files were not included in the text analysis. Their contents are unknown.
- The review is limited to the supplied evidence packets and does not verify the behavior of the application at runtime.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubstefan-500/teamcity-idea-cve-2020-35667-poc
Repository PoCStars: 0Created 2025-11-05ExploitCVE-2020-3566711 files
Analysis
Technical assessment
A Python Flask server that impersonates a TeamCity XML-RPC endpoint to intercept plaintext credentials from a vulnerable IntelliJ plugin. The server generates an RSA key pair, serves the public key to the client, decrypts the client-supplied encrypted password, and logs the captured username and password.
Backdoor review
No backdoor observed in reviewed code
The PoC implements a fake TeamCity XML-RPC server to demonstrate CVE-2020-35667 credential interception. All code behavior is consistent with the stated purpose: it generates an RSA key, serves it to the client, decrypts the client-supplied encrypted password, and logs the plaintext credentials. No concealed backdoor, persistence, unrelated payload, or operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The artifact contains a fully functional server (poc_server.py) that actively impersonates a legitimate TeamCity endpoint to decrypt and capture user credentials. This constitutes an exploit as it exercises the SSRF vulnerability to achieve credential interception, not merely detecting or reporting it.
poc_server.py:1-203README.md:10-17Requirements
- Victim must configure the vulnerable TeamCity IntelliJ plugin to connect to the attacker-controlled server URL.
README.md:44-45 - Attacker must run the poc_server.py script, which listens on a specified host and port.
poc_server.py:199-203
Observed behavior
- Starts a Flask web server listening on 127.0.0.1:8888.
poc_server.py:199-203 - Generates a 1024-bit RSA key pair and stores it as rsa.pem if it does not already exist.
poc_server.py:70-77 - Responds to getPublicKey XML-RPC method by returning the RSA public key modulus and exponent as a hex string.
poc_server.py:113-123 - Receives an authenticate XML-RPC request containing a username and an encrypted password hex string.
poc_server.py:125-143 - Decrypts the password using the stored RSA private key and logs the captured plaintext username and password.
poc_server.py:160-171
Behaviors behind the backdoor verdict
Observables
- Credential Capture
- Payload withheldThis is the core PoC demonstration of the SSRF vulnerability; it is expected behavior for a credential interception proof-of-concept.
poc_server.py:160-171 - Key Generation
- Payload withheldThe server creates a key pair to mimic the legitimate TeamCity server's public key exchange, enabling decryption of the intercepted password.
poc_server.py:70-77
What the analysis did not establish
- Evidence does not include the content of REPORT.md or ANALYSIS.md files, which are referenced in README.md but not provided in the selected text.
- The artifact's non-text media files (4 files, 619918 bytes) were not analyzed; their content is unknown.
- The analysis is based solely on the provided source code and documentation; no dynamic execution or verification was performed.
- Four non-text media files (619918 bytes) and four unclassified files (42917 bytes) were present in the repository but not analyzed; their content is unknown.
- The review is limited to static analysis of the provided source code; no dynamic execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.