Dungsocool

Classification basis

The artifact includes a functional Python script (exploit.py) that implements a multi-stage attack chain. It serves a phishing page to trigger a reflected XSS vulnerability, uses DOM clobbering to load a second-stage JavaScript payload, and that payload automatically creates a new administrator account on the target. This is code intended to exercise a vulnerability for account takeover, which is the definition of an exploit.

Requirements

• A WordPress site vulnerable to CVE-2026-64638 (versions prior to 7.0.3).README.md:5
• An administrator of the target site must be tricked into clicking a link to the attacker's phishing page.README.md:13

Observed behavior

• The exploit.py script starts an HTTP server that serves a phishing page (/phish.html) and a malicious JavaScript file (/evil.js).wp-src/exploit.py:98-126
• The phishing page contains a hidden form that auto-submits a POST request to the target's /wp-login.php with a crafted username containing a DOM clobbering payload.wp-src/exploit.py:64-96
• The DOM clobbering payload injects a <div> element that overwrites the legitimate emoji settings, causing the browser to load the attacker's evil.js script.wp-src/exploit.py:66-76
• The evil.js script, running in the admin's browser context, fetches a nonce from the WordPress admin panel and then sends a POST request to create a new administrator account named 'backdoor_xss2shell'.wp-src/exploit.py:19-62
• The script sends a callback to the attacker's server upon successful creation of the backdoor admin account.wp-src/exploit.py:55-60

Observables

Exploit Behavior

Payload withheldThis is the normal exploit behavior for the described CVE-2026-64638 vulnerability, targeting the stated WordPress login XSS. It does not indicate a backdoor against the person running the PoC.wp-src/exploit.py:19-62wp-src/exploit.py:64-96wp-src/exploit.py:105-126

Classification basis

The README.md contains explicit, executable curl commands that, when sent to a vulnerable server, trigger the file inclusion vulnerability to achieve Remote Code Execution. This is code intended to exercise a vulnerability, meeting the definition of an exploit.

Requirements

• A PHP file must be placed on the target server at a path predictable from the Content-Dir header, such as /tmp/bmi/includes/bypasser.php.README.md:239-247
• The target must be running a vulnerable version of the Backup Migration plugin (<= 1.3.7).README.md:5

Observed behavior

• Sends a single POST request to /wp-content/plugins/backup-backup/includes/backup-heart.php with a crafted Content-Dir header pointing to an attacker-controlled directory.README.md:253-274
• The server includes and executes the attacker's PHP file (bypasser.php) located in the specified directory, resulting in arbitrary command execution.README.md:244-246README.md:280
• Demonstrates impact by reading wp-config.php database credentials and gathering system information (uname, hostname).README.md:287-289README.md:307-309

Observables

Vulnerability Writeup

Payload withheldThe write-up is a standard security research document explaining the vulnerability and demonstrating exploitation for educational purposes. It does not contain instructions for backdooring the reader's system.README.md:1-375

Source Code

Payload withheldThe file defines constants, includes required files, and initializes the plugin. It does not contain any obfuscated or suspicious code.wp-src/backup-backup.php:1-69

Source Code

Payload withheldThese files are a standard third-party analytics library for WordPress plugins. They handle SDK version resolution and account registration. No backdoor behavior is present.wp-src/analyst/autoload.php:1-40wp-src/analyst/main.php:1-36wp-src/analyst/sdk_resolver.php:1-79

Source Code

Payload withheldThe file deletes backup files and configuration based on user settings. It is a standard uninstall routine.wp-src/uninstall.php:1-70

Classification basis

The artifact is a technical report (writeup) that analyzes the vulnerability, provides code snippets for illustration, and describes an attack chain. It does not contain a functional exploit script or a scanner; the HTTP request shown is a static example within a narrative, not executable code.

Requirements

• Kirki Customizer Framework 6.0.0–6.0.6 is activatedCVE-2026-8206_Report_EN.md:28
• REST API is public (WordPress default)CVE-2026-8206_Report_EN.md:29
• ComponentLibrary module is active (default when the plugin is active)CVE-2026-8206_Report_EN.md:30

Observed behavior

• Describes sending a POST request to the kirki-forgot-password endpoint with a victim's username and attacker's email to hijack a password reset link.CVE-2026-8206_Report_EN.md:179-185
• Explains the root cause: the handle_forgot_password function does not validate that the provided email matches the user's registered email.CVE-2026-8206_Report_EN.md:55-78
• Outlines a full attack chain from password reset hijacking to admin login and webshell upload for RCE.CVE-2026-8206_Report_EN.md:111-118

Observables

Vulnerability Documentation

Payload withheldThe artifact documents a privilege escalation vulnerability in the Kirki plugin, including example exploit steps and remediation advice.CVE-2026-8206_Report_EN.md:1-320README.md:1-329

Classification basis

The artifact contains a complete, automated Python script (exploit.py) that exercises the described vulnerabilities to achieve remote code execution. The script implements all phases of the attack chain: route confusion, SQL injection, login, webshell upload, and command execution. The README.md provides a detailed technical analysis and instructions for running the exploit. This is clearly code intended to exploit the vulnerabilities, not merely detect or analyze them.

Requirements

• Target must be running a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API enabled (default).README.md:7README.md:112-115exploit.py:13
• The target must have at least one published post (default 'Hello World' exists).README.md:120
• The attacker must be able to send HTTP requests to the target's REST API batch endpoint.exploit.py:45-48

Observed behavior

• Sends a batch request with a malformed path ('///') to trigger route confusion and bypass authentication.exploit.py:54-88README.md:326-339
• Performs boolean-based blind SQL injection via the 'author_exclude' parameter to extract the admin username and password hash from the database.exploit.py:94-202README.md:341-361
• Attempts to log in to the WordPress admin panel using a list of common passwords.exploit.py:208-244README.md:363-367
• Uploads a malicious PHP webshell as a WordPress plugin and activates it.exploit.py:250-333README.md:369-376
• Executes arbitrary operating system commands on the target server via the uploaded webshell.exploit.py:339-346README.md:378-383

Observables

Target Url

Payload withheldAll HTTP requests in exploit.py are sent to the target URL provided by the operator via command-line argument.exploit.py:391-397

Webshell Token

Payload withheldThe webshell uploaded to the target uses a hardcoded token for access control. This is a standard practice in PoC exploits to prevent unauthorized use of the shell on the target.exploit.py:31

Exploit Chain

Payload withheldThe entire exploit chain is explicitly described in the README and implemented in exploit.py, targeting the operator-specified WordPress instance.README.md:9-11exploit.py:1-5

Classification basis

The artifact is a detailed technical analysis and walkthrough of exploiting CVE-2014-3120. It describes the vulnerability, the target environment, and the steps to achieve RCE, but it does not provide any standalone executable code. The curl commands are illustrative examples within the narrative, not a functional exploit or scanner script. The analysis_routing classification is 'NO_POC_CODE_IDENTIFIED'.

Requirements

• Target must be running Elasticsearch version prior to 1.2 with dynamic scripting enabled.README.md:81
• The Elasticsearch REST API must be accessible without authentication.README.md:66

Observed behavior

• Sends a search request with a harmless MVEL script ('1+1') to confirm dynamic scripting is active.README.md:149-163
• Sends a search request with a malicious MVEL script that executes the 'id' command via Java's Runtime.exec() and returns the output in the JSON response.README.md:202-218
• Sends a search request with a malicious MVEL script that reads the '/etc/shadow' file and returns its contents.README.md:253-269

Observables

Target Ip

Payload withheldIP address of the target Elasticsearch instance used in the lab write-up.README.md:29

Target Port

Payload withheldElasticsearch HTTP REST API port targeted in the exploit.README.md:48

Exploit Payload

Payload withheldMVEL payload used to achieve remote code execution via Elasticsearch dynamic scripting.README.md:214

Classification basis

The artifact is a README.md file containing a detailed technical narrative of vulnerability analysis and exploitation steps, including commands and their output. It does not contain executable exploit or scanner code; it is a documentation writeup.

Requirements

• Target must be running a vulnerable version of Drupal (e.g., 8.5.0) without the CVE-2018-7600 patch.README.md:44-54
• A Drupal endpoint using the Form API (e.g., /user/register) must be accessible and not redirect to the installer.README.md:120-128

Observed behavior

• The document describes using curl to send a crafted POST request to /user/register with render array injection payloads, resulting in the execution of the 'id' command on the server and returning the output 'uid=33(www-data)'.README.md:164-175

Observables

Exploit Command

Payload withheldThis is the documented exploit payload targeting the stated CVE-2018-7600 vulnerability. It uses the standard render array injection technique to execute 'id' on the target Drupal instance. The command is consistent with normal PoC behavior for this CVE and does not exhibit backdoor characteristics.README.md:165-168

Target Ip

Payload withheldInternal lab IP address used as the target for the documented exploit. This is a private RFC 1918 address typical of lab environments and does not indicate exfiltration or malicious intent.README.md:27

Classification basis

The artifact is a detailed technical analysis and walkthrough of exploiting CVE-2017-12635 and CVE-2017-12636. It contains no executable code, only documentation and curl command examples. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is a writeup describing the exploitation process.

Requirements

• Target running Apache CouchDB 1.6.0 with HTTP API exposed on port 5984README.md:27-29

Observed behavior

• Sends a PUT request to /_users with duplicate 'roles' keys to create an admin userREADME.md:54-64
• Modifies query_servers configuration via /_config to inject an OS commandREADME.md:109-113
• Creates a design document with a view using the injected query server language to trigger command executionREADME.md:119-137

Observables

Command

Payload withheldDemonstrates the CVE-2017-12635 privilege escalation exploit by creating a user with duplicate 'roles' keys.README.md:55-63

Command

Payload withheldDemonstrates the CVE-2017-12636 remote code execution exploit by registering a malicious query server.README.md:110-112

Command

Payload withheldVerification step to confirm the RCE payload executed inside the Docker container.README.md:151

Classification basis

The artifact is a README.md file containing a step-by-step technical analysis, exploitation walkthrough, and risk assessment for CVE-2017-18349. It includes code snippets (Java, bash) and commands but is a documentation writeup, not a standalone executable exploit or scanner.

Requirements

• Target must be running Fastjson version 1.2.24 or earlier with AutoType enabled.README.md:78-80
• Target JVM must allow remote codebase loading via JNDI (e.g., Java 8u102).README.md:96-98
• Attacker must control an LDAP server and HTTP server to serve the malicious class.README.md:186-189

Observed behavior

• Sends a crafted JSON POST request with @type set to com.sun.rowset.JdbcRowSetImpl and dataSourceName pointing to attacker's LDAP server.README.md:228-231
• Victim JVM performs JNDI lookup to attacker's LDAP server, downloads and executes a malicious class, resulting in a reverse shell.README.md:154-160

Observables

Ip Address

Payload withheldTarget victim IP address used in the documented lab exploitation scenario.README.md:22

Ip Address

Payload withheldAttacker-controlled IP address used for reverse shell and JNDI/LDAP callback in the documented lab exploitation scenario.README.md:172

Url

Payload withheldJNDI LDAP endpoint generated by the attacker's tool to trigger remote class loading in the documented lab exploitation scenario.README.md:212

Command

Payload withheldReverse shell payload embedded in the Java Exploit class used in the documented lab exploitation scenario.README.md:172

Classification basis

The file payload withheld is a standalone script that actively generates a malicious JWT and sends it to a target InfluxDB instance to execute arbitrary queries, which constitutes exploitation code. The README.md documents the same exploitation steps manually. Both artifacts are designed to exercise the CVE-2019-20933 vulnerability, not merely detect it.

Requirements

• Target InfluxDB version < 1.7.6 with JWT authentication enabled and empty shared-secretREADME.md:69exploit_influxdb.py:28-29
• Network access to the InfluxDB HTTP API (default port 8086)exploit_influxdb.py:38-40

Observed behavior

• Generates a JWT with header {'alg':'HS256','typ':'JWT'} and payload containing a username (default 'admin') and a far-future expiration, signed with an empty HMAC-SHA256 key.exploit_influxdb.py:15-35
• Sends an HTTP GET request to the /query endpoint with the forged JWT in the Authorization: Bearer header and a user-supplied InfluxQL query.exploit_influxdb.py:37-45
• Prints the JSON response from the server if the query succeeds, indicating successful authentication bypass and data retrieval.exploit_influxdb.py:75-77

Observables

Exploit Script

Payload withheldPython script that generates a forged JWT with an empty secret and sends queries to an InfluxDB instance to exploit CVE-2019-20933.exploit_influxdb.py:1-82

Jwt Generation

Payload withheldThe script explicitly uses an empty byte string as the HMAC key to exploit the CVE-2019-20933 vulnerability.exploit_influxdb.py:28-29

Target Interaction

Payload withheldThe script sends the forged JWT to the target InfluxDB API to execute arbitrary queries, consistent with the documented exploit.exploit_influxdb.py:37-45

Classification basis

The artifact includes a functional Python script (exploit_supervisor.py) that actively exploits CVE-2017-11610 by sending a malicious XML-RPC request to execute arbitrary commands on a vulnerable Supervisord instance. The accompanying writeup (README.md) provides a step-by-step exploitation guide and confirms successful RCE. This constitutes exploit code intended to exercise the vulnerability.

Requirements

• Target must be running a vulnerable version of Supervisord (<= 3.3.2) with the XML-RPC interface exposed without authentication.README.md:53README.md:72

Observed behavior

• The exploit script connects to the target's /RPC2 XML-RPC endpoint and sends a method call with a namespace traversal chain (payload withheld) to execute an arbitrary shell command.exploit_supervisor.py:10-16
• The writeup demonstrates manual exploitation by sending crafted XML-RPC requests via curl, confirming RCE by writing the output of the 'id' command to /tmp/rce_proof.txt and verifying it inside the container.README.md:193-206

Observables

Exploit Chain

Payload withheldThe documented and scripted attack chain traverses Supervisor's internal Python object attributes to reach os.system for command execution, consistent with the published CVE-2017-11610 vulnerability.README.md:109-111exploit_supervisor.py:13

Command Execution

Payload withheldThe README demonstrates executing the 'id' command via the XML-RPC exploit and verifying the output, proving remote code execution as the 'nobody' user.README.md:188-206

Script Behavior

Payload withheldThe Python script automates the documented exploit without any hidden or unrelated functionality; it only performs the advertised CVE-2017-11610 exploitation.exploit_supervisor.py:1-32

Classification basis

The artifact is a Markdown document providing a step-by-step technical analysis, explanation of the vulnerability, and manual exploitation methodology. It contains no executable code, scripts, or automated scanning logic. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is purely descriptive.

Requirements

• Target running Oracle WebLogic Server 10.3.6.0 with wls-wsat component enabledREADME.md:9-13
• Network access to the WebLogic server on port 7001README.md:10

Observed behavior

• Describes sending a crafted SOAP XML payload to /wls-wsat/CoordinatorPortType to achieve remote code execution via XMLDecoder deserializationREADME.md:159-191
• Describes bypassing blind RCE by writing command output to a web-accessible directory and retrieving it via HTTPREADME.md:116-133
• Describes post-exploitation activities including reading /etc/shadow and verifying root privilegesREADME.md:207-256

Observables

Target Endpoint

Payload withheldThe documented exploit target endpoint for CVE-2017-10271.README.md:53

Exploit Payload

Payload withheldThe core exploit mechanism described in the writeup.README.md:159-183

Post Exploitation Action

Payload withheldDemonstrates post-exploitation data exfiltration technique.README.md:218-243

Classification basis

The artifact is a Markdown document that provides a step-by-step technical analysis of CVE-2017-5638, including environment reconnaissance, version identification, and behavioral verification. While it contains a complete exploit payload in a curl command, the document's primary purpose is to explain the vulnerability and the exploitation process, making it a writeup.

Requirements

• Target must run Apache Struts 2.3.30 with Jakarta multipart parser and an upload endpoint.README.md:51-69

Observed behavior

• Sends a crafted HTTP POST request with a malicious OGNL payload in the Content-Type header to achieve remote code execution.README.md:152-155
• Executes the 'id' command on the target server and returns the output, confirming root-level access.README.md:157-159

Observables

Exploit Payload

Payload withheldThe README provides a complete curl command (lines 152-155) that exploits CVE-2017-5638 against a vulnerable Struts2 instance. This is the documented exploit, not a backdoor.README.md:152-155

Target Endpoint

Payload withheldThe exploit targets a local IP address, consistent with a lab environment. No external or attacker-controlled infrastructure is referenced.README.md:152