TheCyberGeek
Source-scoped identity with 8 associated PoCs and 8 linked vulnerabilities.
Exploit catalog results
Showing 8 PoCs on this page
GitHubTheCyberGeek/CVE-2026-4480-PoC
Repository PoCStars: 21Created 2026-06-05ExploitCVE-2026-44802 files
Analysis
Technical assessment
The artifact is a Python script (exploit.py) that exploits CVE-2026-4480, an unauthenticated remote code execution vulnerability in the Samba printing subsystem. It sends a malicious print job with a shell-injected job name (%J) to a target Samba server, causing the server to execute an attacker-supplied command or reverse shell.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-4480, a Samba print-command injection vulnerability. The Python script (exploit.py) and README.md describe and implement the exploit as expected: connecting to a Samba printer share, submitting a print job with a malicious job name containing shell metacharacters, and triggering remote code execution via a reverse shell or arbitrary command. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or deceptive behavior was observed. The code performs only the advertised exploit actions.
Classification basis and observed behavior
Classification basis
The Python script exploit.py actively connects to a target, injects a shell command via the %J substitution, and triggers remote code execution. It is not a scanner or writeup; it is functional exploit code.
exploit.py:1-85Requirements
- Target Samba server with a guest-accessible printer share whose 'print command' references %J
README.md:28 - Network access to the target's SMB port (445/139)
README.md:27 - Python3 with Samba Python bindings installed on the attacker machine
README.md:23-26
Observed behavior
- Connects to the target Samba server's spoolss named pipe as an anonymous guest
exploit.py:34-35 - Opens a specified printer share with PRINTER_ACCESS_USE rights
exploit.py:37-38 - Sets the document name to 'payload withheld', which is the shell-injected payload that will be substituted into %J
exploit.py:41 - Writes the attacker-supplied command or reverse shell payload as the spool file body
exploit.py:50 - Triggers the print command execution by calling EndDocPrinter, causing the target to execute the injected command
exploit.py:52
Behaviors behind the backdoor verdict
Observables
- Reverse Shell
- Payload withheldThe reverse_shell function constructs a Bash reverse shell payload using attacker-supplied LHOST and LPORT. This is the intended exploit behavior.
exploit.py:19-24 - Command Injection
- Payload withheldThe document_name is set to 'payload withheld', which is the shell injection payload placed into the %J substitution. This triggers command execution when the print command is invoked.
exploit.py:41 - Arbitrary Command Execution
- Payload withheldThe -c/--cmd option allows running an arbitrary shell command instead of a reverse shell. This is a documented feature of the PoC.
exploit.py:64-69
What the analysis did not establish
- Evidence is limited to the supplied text files; no binary or network traffic was analyzed.
- The exploit's success depends on a specific vulnerable Samba configuration (print command referencing %J, guest-accessible printer share).
- Only the two text files in the repository were reviewed; no binary or other file types were present.
- The review does not assess the safety or reliability of the exploit code when executed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubTheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE
Repository PoCStars: 10Created 2026-03-23ExploitCVE-2026-38885 files
Analysis
Technical assessment
The artifact contains two complete, multi-phase exploit implementations (SUID and Capabilities variants) for CVE-2026-3888 that achieve local privilege escalation to root by winning a TOCTOU race condition between snap-confine and systemd-tmpfiles.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and two C source files implementing a local privilege escalation exploit for CVE-2026-3888. The code performs the documented exploit steps: entering a snap sandbox, waiting for a directory cleanup, winning a TOCTOU race against snap-confine, and planting a payload to obtain root privileges. All behavior is consistent with the stated purpose of demonstrating the vulnerability. No concealed backdoor, unrelated remote access, credential theft, persistence mechanism, or deceptive payload targeting the person running the PoC was observed.
Classification basis and observed behavior
Classification basis
The artifact contains complete, compilable C source code (exploit_suid.c and exploit_caps.c) that implements a multi-phase attack chain designed to exercise the CVE-2026-3888 vulnerability and achieve local privilege escalation to root. The README documents the exploit steps, build instructions, and expected output showing a root shell. This is code intended to exploit a vulnerability, not merely detect or analyze it.
exploit_suid.c:1-717exploit_caps.c:1-757README.md:1-362Requirements
- Unprivileged local user access on Ubuntu 24.04+ with unpatched snapd (< 2.74.2)
README.md:99 - snap-confine must be SUID-root (Variant 1) or have specific capabilities (Variant 2)
README.md:100README.md:231 - A snap with layout bind-mounts installed (firefox for SUID, snap-store for Capabilities)
README.md:101README.md:232 - systemd-tmpfiles-clean.timer must be active
README.md:102 - busybox must be available on the target
README.md:103
Observed behavior
- Enters a snap sandbox (firefox or snap-store) and waits for systemd-tmpfiles to delete the stale /tmp/.snap directory
exploit_suid.c:302-340exploit_suid.c:350-394 - Destroys the cached mount namespace to force snap-confine to rebuild it from scratch
exploit_suid.c:404-421 - Creates a controlled .snap directory tree and races snap-confine by monitoring its stderr via an AF_UNIX socket, swapping directories when a trigger string is detected
exploit_suid.c:148-292 - Injects a payload (overwrites ld-linux-x86-64.so.2 or sets up ld.so.preload) into the poisoned namespace to execute arbitrary code as root
exploit_suid.c:461-516exploit_caps.c:504-552 - Triggers root execution by invoking snap-confine again, which loads the attacker-controlled library with elevated privileges, resulting in a SUID root bash shell
exploit_suid.c:527-551exploit_suid.c:560-605
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldAll actions (sandbox entry, directory manipulation, race condition exploitation, payload injection, and root shell execution) are consistent with the documented CVE-2026-3888 exploit.
exploit_suid.c:1-717exploit_caps.c:1-757README.md:1-362
What the analysis did not establish
- Two files (librootshell_suid.c and librootshell_caps.c) are referenced in the README and build instructions but are not included in the supplied evidence packets. The analysis is based on the three provided text files (README.md, exploit_suid.c, exploit_caps.c).
- The evidence packet reports complete_artifact_coverage as false and notes 2 unclassified files (likely the missing payload source files) that were not analyzed.
- Two files (librootshell_suid.c and librootshell_caps.c) are referenced in the README and build instructions but were not included in the supplied text evidence. Their content could not be reviewed.
- The analysis is limited to the supplied text; no binary analysis or dynamic execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.