0xCyberstan
Source-scoped identity with 6 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
GitHub0xCyberstan/CVE-2026-42533-POC
Repository PoCStars: 0Created 2026-08-05ExploitCVE-2026-425339 files
Analysis
Technical assessment
The artifact is a full exploit for CVE-2026-42533, a heap buffer overflow in NGINX. It includes a Python script (poc.py) that chains an information leak to defeat ASLR and a heap overflow to achieve pre-auth remote code execution (RCE) by overwriting a pool cleanup handler to call system(). The repository also contains supporting scripts for calibration, leak validation, and triggering the vulnerability across multiple code paths.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-42533, a publicly disclosed heap buffer overflow in NGINX. All provided scripts and documentation describe legitimate exploit behavior targeting the stated vulnerability: triggering the overflow, leaking heap/libc pointers, and achieving remote code execution via a forged pool cleanup chain. No evidence of concealed backdoor behavior, credential theft, unrelated remote access, persistence mechanisms, or deceptive payloads was observed. The code is consistent with a security research PoC intended for defenders and reproduction.
Classification basis and observed behavior
Classification basis
The primary artifact, poc.py, contains code that exercises the CVE-2026-42533 vulnerability to achieve remote code execution. It implements a full exploit chain including an information leak, heap grooming, a heap overflow, and a control-flow hijack to call system(). The README explicitly describes the --rce mode as 'Full pre-auth RCE' and the code confirms this by checking for the creation of a file written by the executed command.
README.md:56-57exploits/poc.py:205-296Requirements
- A vulnerable version of NGINX (0.9.6 through 1.30.3, 1.31.2) must be running with a configuration that uses a map directive with regex matching and a string expression referencing the map's regex capture variables before the map output variable.
README.md:3-7README.md:21-24 - The attacker must be able to send HTTP requests to the vulnerable NGINX server.
README.md:100-101
Observed behavior
- The exploit sends a crafted GET request to trigger an information leak, causing the server to return a response body containing uninitialized heap memory, which includes a libc pointer and a heap pointer.
exploits/poc.py:33-52docs/EXPLOITATION.md:29-67 - The exploit uses the leaked pointers to calculate the base addresses of libc and the heap, defeating ASLR.
exploits/poc.py:197-201docs/EXPLOITATION.md:58-67 - The exploit grooms the heap by opening multiple connections and closing one to create a hole, then sends a crafted POST request that triggers a heap buffer overflow, overwriting a neighboring connection's pool metadata.
exploits/poc.py:249-269docs/EXPLOITATION.md:103-118 - The overflow rewrites the pool's cleanup function pointer to point to a fake cleanup structure in the POST body, which contains the address of system() and a command string.
exploits/poc.py:74-109docs/EXPLOITATION.md:120-161 - Closing the corrupted connection causes NGINX to tear down the pool and execute the attacker's command via system(), achieving remote code execution.
exploits/poc.py:272-284docs/EXPLOITATION.md:169-180
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe PoC scripts (poc.py, leak_multi.py, named_capture_poc.py, calibrate.py) and documentation (README.md, EXPLOITATION.md) describe and implement a full exploit chain for the stated vulnerability, including heap grooming, pointer leak, and pool cleanup hijacking to call system(). This is normal exploit behavior against the target.
exploits/poc.py:1-393docs/EXPLOITATION.md:1-280README.md:1-245 - Command Execution
- Payload withheldThe RCE payload writes the output of 'id' to /tmp/PWNED. This is a standard proof-of-execution marker used in exploit demonstrations and does not indicate a backdoor.
exploits/poc.py:206exploits/poc.py:302 - Target Identification
- Payload withheldThe exploit is explicitly designed for the vulnerable NGINX version and configuration described in the CVE. It does not target unrelated software or perform actions outside the scope of the vulnerability.
README.md:3-24configs/nginx_poc.conf:1-45
What the analysis did not establish
- The evidence includes 2 unclassified binary files (total 15168 bytes) that were not analyzed, but their content is not required for classification as the provided text files contain the complete exploit logic.
- The analysis is based solely on the provided text content; the code was not executed, and its reliability or safety is not verified.
- Two files (total 15168 bytes) were classified as unclassified/binary and were not analyzed; their content is unknown but they are flagged as metadata-only.
- The review is limited to the supplied text evidence; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xCyberstan/CVE-2026-53360-POC
Repository PoCStars: 0Created 2026-07-04ExploitCVE-2026-533604 files
Analysis
Technical assessment
A guest kernel module (trigger.c) that exploits CVE-2026-53360, a heap out-of-bounds vulnerability in the Linux kernel's KVM SEV-SNP Page State Change (PSC) handler. The module crafts malicious VMGEXIT requests to cause the host to read and write beyond an allocated buffer, leaking host heap layout and corrupting adjacent slab objects.
Backdoor review
No backdoor observed in reviewed code
The artifact is a proof-of-concept (PoC) for CVE-2026-53360, a Linux kernel vulnerability in KVM's SEV-SNP PSC handling. It consists of a README, a Makefile, and a guest kernel module (trigger.c). The code performs only the described vulnerability demonstration: it crafts malformed PSC requests to trigger out-of-bounds reads and writes on the host kernel heap. No backdoor, trojan, or deceptive behavior was observed. The module checks for an SEV-SNP environment, runs four stages of probing/writing/scanning/spraying, and unloads itself. There is no persistence, credential theft, unrelated remote access, or concealed payload.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, compilable kernel module (trigger.c) that actively exploits the vulnerability by sending crafted VMGEXIT requests to the host hypervisor, causing out-of-bounds reads and writes. The README explicitly describes it as a 'Proof of concept' that 'corrupts host kernel heap memory' and 'leaks host heap layout information', and the code implements the described exploitation stages.
README.md:3-7trigger.c:1-13trigger.c:344-427Requirements
- The attacker must control a guest VM running on an AMD SEV-SNP enabled host.
README.md:30-31 - The host kernel must be vulnerable (versions 6.10 through 7.1-rc5, before the fix).
README.md:15-16 - The attacker must be able to load a kernel module (trigger.ko) inside the guest VM.
README.md:210-215
Observed behavior
- The module crafts a PSC request with a small allocation size (24 bytes) and a large end_entry value, causing the host to read and write past the allocated buffer into adjacent kernel heap objects.
trigger.c:112-139trigger.c:67-69 - Stage 1 probes out-of-bounds entries to map the host heap (zero vs. non-zero memory).
trigger.c:169-210 - Stage 2 demonstrates a persistent out-of-bounds write by writing a value into an adjacent slab object and confirming it is skipped on a subsequent request.
trigger.c:218-276 - Stage 3 performs a single scan with end_entry=200 to measure the reach of the out-of-bounds access.
trigger.c:282-302 - Stage 4 fires 200 VMGEXITs with out-of-bounds entries to repeatedly trigger the vulnerability and generate KASAN reports on the host.
trigger.c:310-342
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThe code matches the described PoC behavior: it allocates a 24-byte scratch buffer, sets end_entry beyond the buffer size, and issues VMGEXITs to cause host kernel slab out-of-bounds access.
trigger.c:67-70trigger.c:112-139trigger.c:169-210trigger.c:218-276trigger.c:282-302trigger.c:310-342 - Environment Check
- Payload withheldThe module refuses to run outside an SEV-SNP guest, limiting its effect to the intended vulnerable host configuration.
trigger.c:355-364 - Self Termination
- Payload withheldThe module does not persist in the kernel; it runs its stages and exits, leaving no resident code.
trigger.c:425-426
What the analysis did not establish
- The evidence includes a complete README and trigger.c source code, but one file (LICENSE) is omitted from the text content, though its metadata is present. This does not affect classification.
- The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness is not verified.
- One file (LICENSE) was classified as binary and not analyzed for text content; it is a standard GPL-2.0 license file per the README and is unlikely to contain executable code.
- The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xCyberstan/CVE-2026-42533-Config-Scanner
Repository PoCStars: 29Created 2026-07-04ScannerCVE-2026-425332 files
Analysis
Technical assessment
A Python-based static analysis scanner that parses nginx configuration files to detect patterns vulnerable to CVE-2026-42533, a heap buffer overflow in the complex_value two-pass capture-clobbering bug class. It does not exploit the vulnerability; it only reads config files and reports findings.
Backdoor review
No backdoor observed in reviewed code
The repository contains a static analysis scanner for the CVE-2026-42533 nginx vulnerability. The Python script and README describe and implement a read-only config parser that flags vulnerable patterns. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a read-only static analysis tool that parses nginx configuration files to detect vulnerable patterns. It does not contain any code to send crafted HTTP requests, trigger the buffer overflow, or execute a payload. The README explicitly states it 'does not exploit anything and does not touch the running server' and the code only performs file I/O and analysis.
README.md:3-7nginx_capture_clobber_scan.py:2-9Requirements
- Read access to nginx configuration files on the local filesystem.
nginx_capture_clobber_scan.py:110-111 - Python 3.6+ with standard library only.
README.md:9
Observed behavior
- Parses nginx configuration files, including following 'include' directives, to identify locations where a regex capture variable and a regex map variable share a two-pass buffer in an exploitable order.
nginx_capture_clobber_scan.py:307-375README.md:35-52 - Outputs a report (text or JSON) listing vulnerable configurations, cleared (safe but fragile) configurations, and any unreadable include files. Exits with code 1 if vulnerabilities are found, 0 otherwise.
nginx_capture_clobber_scan.py:443-515README.md:80-92 - Does not send any network requests, does not interact with a running nginx server, and does not attempt to trigger the vulnerability.
README.md:3-7nginx_capture_clobber_scan.py:2-9
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldExternal reference to a vulnerability write-up and exploit chain, mentioned in README and script docstring. The URL itself is not executed by the artifact.
README.md:12README.md:147
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files in the repository were included. Only two text files (README.md and nginx_capture_clobber_scan.py) are provided, and the analysis scope notes TEXT_EXCEEDS_ONE_CALL_BUDGET. Other files, if any exist in the repository, were not inspected.
- Only the two text files (README.md and nginx_capture_clobber_scan.py) were provided and reviewed. No binary files were present. The review does not verify the correctness or safety of the external URL payload withheld.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xCyberstan/CVE-2026-31694-POC
Repository PoCStars: 16Created 2026-06-30ExploitCVE-2026-3169411 files
Analysis
Technical assessment
A local privilege escalation exploit for CVE-2026-31694, a FUSE readdir cache out-of-bounds write in the Linux kernel. The exploit.c file implements a FUSE server that returns an oversized dirent, causing a 24-byte heap overflow. It uses page grooming to target the page cache of /etc/passwd, overwriting the root password field to achieve passwordless root access.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-31694, a Linux kernel FUSE readdir cache out-of-bounds write. The provided source code (exploit.c, Makefile, README.md) implements the described vulnerability exploitation and local privilege escalation to modify /etc/passwd. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the person running the PoC was observed. The code's behavior is consistent with the documented exploit functionality.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, compilable C program (exploit.c) that actively exploits CVE-2026-31694 to achieve local privilege escalation by corrupting /etc/passwd. The README describes it as a 'marker PoC for the write primitive and a local privilege escalation' and provides instructions for running it to gain root. This is code intended to exercise a vulnerability, not merely detect it.
README.md:8-10exploit.c:1-19exploit.c:394-527Requirements
- Requires a vulnerable Linux kernel (6.15+ before fix) with FUSE support and a local unprivileged user account.
README.md:12-13 - Requires fusermount3 and the ability to mount FUSE filesystems.
exploit.c:367-369
Observed behavior
- Sets up a malicious FUSE server that returns a dirent with namelen=4095, causing a 24-byte overflow past a page boundary.
exploit.c:193-201 - Drains per-CPU page freelists and allocates a pool of pages to groom physical adjacency between a freed page and the /etc/passwd page cache.
exploit.c:226-256 - Triggers the overflow to overwrite the root entry in /etc/passwd with a passwordless line, then uses su to gain a root shell.
exploit.c:302-353exploit.c:469-521
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the intended and documented behavior of the PoC, not a hidden backdoor.
exploit.c:56-57exploit.c:302-353exploit.c:461-521 - Payload
- Payload withheldThis payload is directly related to the LPE goal of creating a passwordless root user.
exploit.c:56-57 - Post Exploitation
- Payload withheldThis is part of the documented LPE flow to finalize the privilege escalation.
exploit.c:497-506
What the analysis did not establish
- Only 3 of 11 files in the repository were provided as text; 8 files (including shell scripts in vm/ and a LICENSE file) were omitted due to budget constraints.
- The evidence packet reports complete_artifact_coverage as false, so the full repository content is not available for analysis.
- 8 files (likely shell scripts in the vm/ directory) were omitted from the text evidence. Their content was not reviewed, but the README describes them as VM setup and execution scripts, which is consistent with the PoC's purpose.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xCyberstan/CVE-2026-46215-POC
Repository PoCStars: 11Created 2026-06-18ExploitCVE-2026-462153 files
Analysis
Technical assessment
A full local privilege escalation exploit for CVE-2026-46215, a use-after-free in the Linux kernel's DRM GEM change_handle ioctl. The exploit races GEM_CHANGE_HANDLE against GEM_CLOSE to create a dangling handle, reclaims the freed object with a pipe_buffer spray, leaks a kernel pointer to bypass KASLR, uses FLINK to set the PIPE_BUF_FLAG_CAN_MERGE flag, and overwrites /etc/passwd to create a passwordless root account.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-46215, a Linux kernel DRM GEM use-after-free vulnerability. The code performs a local privilege escalation by racing ioctls, reclaiming freed memory with pipe buffers, leaking a kernel pointer, and overwriting /etc/passwd via a DirtyPipe-style technique. All behavior is consistent with the stated exploit goal; no concealed backdoor, unrelated payload, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, functional exploit (poc.c) that exercises the CVE-2026-46215 vulnerability to achieve local privilege escalation by overwriting /etc/passwd. The README explicitly describes it as an exploit and provides a full exploitation chain.
README.md:1-8README.md:39-49poc.c:1-8Requirements
- Access to a DRM render node (/dev/dri/renderD* or /dev/dri/card*)
README.md:5-7 - A vulnerable Linux kernel (v6.18-rc1 through 6.18.31, 6.19 through 7.0.8, 7.1-rc1/rc2) built without CONFIG_KASAN
README.md:11-13README.md:68-69 - A supported DRM driver (virtio_gpu or nouveau) that exposes object size/name at expected offsets
README.md:70-71
Observed behavior
- Races DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE to create a dangling GEM handle
poc.c:158-186poc.c:346-422 - Sprays pipe_buffers to reclaim the freed GEM object's slab slot
poc.c:302-332 - Leaks a kernel pointer (pipe_buf_ops) via a driver info ioctl to bypass KASLR
poc.c:538-550 - Uses DRM_IOCTL_GEM_FLINK to set PIPE_BUF_FLAG_CAN_MERGE on the overlapping pipe_buffer
poc.c:572-592 - Writes to pipes to merge data into the page cache and overwrite /etc/passwd with a passwordless root entry
poc.c:595-604
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe entire codebase implements the described exploit chain against the targeted CVE. No actions beyond the stated LPE are performed.
poc.c:1-655run_exploit.sh:1-146 - Target File Modification
- Payload withheldThe exploit's final payload writes a passwordless root entry to /etc/passwd, which is the documented goal of the PoC.
poc.c:596-598poc.c:626-632 - Network Activity
- Payload withheldNo network sockets, connections, or data exfiltration are present in the code.
poc.c:1-655 - Persistence Mechanism
- Payload withheldThe exploit modifies /etc/passwd for immediate privilege escalation but does not install any persistent backdoor, cron job, or service.
poc.c:1-655
What the analysis did not establish
- Evidence is limited to the three text files provided (README.md, poc.c, run_exploit.sh). No binary files were inspected.
- The exploit's reliability and safety are not verified; the analysis is based solely on the supplied source code and documentation.
- Review is based solely on the supplied text files; no binary analysis was performed.
- The artifact's behavior was not executed or dynamically verified.
- The review does not assess the safety or reliability of the exploit code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub0xCyberstan/CVE-2025-64459-Poc
Repository PoCStars: 2Created 2025-12-01ExploitCVE-2025-6445913 files
Analysis
Technical assessment
A Dockerized Python exploit for CVE-2025-64459, a SQL injection in Django's Q object via dictionary unpacking of the _connector argument. The code constructs a malicious payload, executes a vulnerable filter, and prints the generated SQL and bypassed query results.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a standard proof-of-concept for CVE-2025-64459. It demonstrates a SQL injection vulnerability in Django's Q object via dictionary unpacking. The code creates a local test environment, executes the documented exploit, and prints the resulting SQL and query results. No concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor indicators are present.
Classification basis and observed behavior
Classification basis
The artifact contains executable code that constructs a malicious payload and triggers the vulnerable code path to produce a SQL injection, demonstrating actual exploitation rather than just detection or analysis.
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:9-10CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:24-28Requirements
- Django application using Q(**user_input) or filter(**user_input) with unsanitized user-controlled dictionary keys
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:9
Observed behavior
- Creates test users in the database
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:17-19 - Constructs a malicious dictionary with _connector key set to ') OR 1=1 OR ('
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:24-28 - Passes the malicious dictionary to Q(**search_dict) and executes a filter query
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:9-10 - Prints the generated SQL query showing injected OR 1=1 clause
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:37-40 - Prints query results, demonstrating filter bypass and exposure of admin user
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:44-50
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the documented CVE-2025-64459 exploit behavior and is not a backdoor.
CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:24-28 - Local Environment Setup
- Payload withheldThese settings are consistent with a local PoC and do not indicate a backdoor.
CVE-2025-64459-PoC/app/sqli/settings.py:3CVE-2025-64459-PoC/app/sqli/settings.py:27
What the analysis did not establish
- Two Python __init__.py files are listed as unavailable as text, but they are typically empty and unlikely to affect classification.
- The evidence does not include the Dockerfile or requirements.txt, so the exact vulnerable Django version cannot be confirmed from the provided files.
- Two empty __init__.py files were not included as text but are standard Python package markers and unlikely to contain behavior.
- Seven additional files (e.g., models.py, apps.py, Dockerfile, requirements.txt) were omitted from the text evidence; their content is unknown but the included files show no backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.