bluedragonsecurity

Classification basis

The artifact contains complete C source code that actively exploits CVE-2026-46215 to achieve local privilege escalation by overwriting payload withheld and spawning a root shell. It does not merely detect or report the vulnerability; it exercises the use-after-free to corrupt memory and escalate privileges.

Requirements

• User must be in the 'video' group to open /dev/dri.README.md:74-89
• The system must have a virtio DRM device available.exploit.c:149-175
• The target kernel must be Linux 7.0 (vulnerability exists from 7.0 to 7.0.8).README.md:30-32exploit.c:14-16

Observed behavior

• Opens a virtio DRM device from /dev/dri.exploit.c:149-175
• Creates a GEM buffer object and races DRM_IOCTL_GEM_CHANGE_HANDLE with DRM_IOCTL_GEM_CLOSE to produce a dangling handle.exploit.c:215-247
• Performs heap grooming (defrag, migration, pipe spray) to reclaim the freed GEM object's slab page with pipe buffers.exploit.c:443-545
• Uses the dangling handle with DRM_IOCTL_VIRTGPU_RESOURCE_INFO to leak a kernel pointer for KASLR bypass.exploit.c:547-558
• Writes a crafted 'oot::0:0:dirty:/root:/bin/sh' payload into the pipe buffers to overwrite payload withheld.exploit.c:338exploit.c:562-565
• Spawns a root shell via 'su - root' after successfully overwriting payload withheld.exploit.c:285-335exploit.c:572-583

Observables

Payload

Payload withheldThe exploit writes this string into payload withheld via pipe spray to create a root-equivalent user 'dirty' with UID 0, which is the standard LPE technique for this class of exploit.exploit.c:338exploit.c:564

Privilege Escalation

Payload withheldAfter overwriting payload withheld, the exploit calls root("root") which forkpty's and exec's /bin/su to provide an interactive root shell. This is the intended outcome of the LPE.exploit.c:285-335exploit.c:583

Target File

Payload withheldThe exploit targets payload withheld for overwrite, a common LPE target. It also creates a dummy payload withheld if missing, which is part of the exploit setup.exploit.c:92exploit.c:401-412

Classification basis

The Python script sends a malicious HTTP GET request containing shellcode and SEH overwrite to trigger a buffer overflow and spawn a bind shell, which is the definition of an exploit.

Requirements

• Target running KNet Web Server 1.04b on Windows XP SP3 x86README.md:3
• Attacker must be able to connect to target on port 80knet_exploit.py:96

Observed behavior

• Constructs a buffer containing NOP sled, shellcode, egghunter, and SEH overwrite addressesknet_exploit.py:72-78
• Sends the buffer as part of an HTTP GET request to the target serverknet_exploit.py:84-98
• After a 10-second sleep, opens a telnet connection to the target on port 4444, expecting a bind shellknet_exploit.py:104-106

Observables

Exploit Behavior

Payload withheldThis is the expected behavior of a proof-of-concept exploit for CVE-2005-0575, which describes a buffer overflow in Knet Web Server. The script triggers the vulnerability and then provides a shell to the attacker.knet_exploit.py:84-106

Shellcode

Payload withheldThe shellcode variable contains a payload that opens a bind shell on TCP port 4444, as noted in the comment on line 5. This is consistent with the exploit's purpose.knet_exploit.py:5-60

Classification basis

The code actively sends malicious HTTP requests designed to exploit CVE-2011-3192 and cause a denial of service, which is the definition of an exploit.

Requirements

• Target must be a vulnerable Apache HTTP Server (1.3.x, 2.0.x through 2.0.64, 2.2.x through 2.2.19).README.md:3
• Attacker must be able to establish TCP connections to the target web server port.rapache2.c:82-103

Observed behavior

• Constructs an HTTP HEAD request with a Range header containing 1300 overlapping byte ranges (e.g., bytes=0-,5-0,5-1,...).rapache2.c:20-21rapache2.c:32-50
• Sends the crafted request to the target host and port in a loop, spawning 50 threads that each send the request 10 times, repeating indefinitely.rapache2.c:71-115rapache2.c:117-137
• Includes an anti-debugging check via ptrace(PTRACE_TRACEME) that exits if a debugger is attached.rapache2.c:25-30

Observables

Anti Debugging

Payload withheldThe code uses ptrace to detect if it is being debugged and exits if so. This is a common anti-analysis technique in exploit code but does not constitute a backdoor or trojan.rapache2.c:23-30

Classification basis

The artifact contains executable code that compiles and runs a race condition to escalate privileges and spawn a root shell, which is the definition of an exploit.

Requirements

• Local access to a system running PolicyKit 0.96 with pkexec and polkitd.pkexec.sh:5-13
• Compiler (gcc) and standard build tools available on the target.pkexec.sh:157-158

Observed behavior

• Writes and compiles a setuid helper (suid.c) that executes arbitrary commands as root.pkexec.sh:103-122pkexec.sh:157
• Writes and compiles a race condition launcher (makesuid.c) that forks a child to monitor /proc and a parent to execute pkexec.pkexec.sh:126-154pkexec.sh:158
• Executes the race condition launcher to change ownership and set the setuid bit on the helper binary.pkexec.sh:159-160
• Spawns a root shell via the now setuid helper.pkexec.sh:161-162

Observables

Exploit Behavior

Payload withheldThe behavior matches the described CVE-2011-1485 exploit and does not include unrelated backdoor activity.pkexec.sh:103-162

Classification basis

The C code triggers the vulnerability and relies on the kernel's own SLUB debugging (warn_free_bad_obj) to report the cross-cache free. It does not contain any code to exploit the resulting slab corruption for privilege escalation, information disclosure, or other impacts. The README explicitly states it is 'not a working exploit, just a POC' and the code only prints a message to check dmesg, which is characteristic of a scanner that validates vulnerability presence.

Requirements

• Root privileges (uid=0) to load BPF programs.README.md:170
• Kernel compiled with CONFIG_KFENCE=y, CONFIG_BPF_SYSCALL=y, CONFIG_NET_SCH_INGRESS=y, CONFIG_SLUB_DEBUG=y, CONFIG_STACKDEPOT=y.README.md:163-168

Observed behavior

• Loads a minimal 3-instruction BPF program of type BPF_PROG_TYPE_SCHED_CLS.cve-2026-31429-poc-only.c:28-32cve-2026-31429-poc-only.c:55-64
• Calls BPF_PROG_TEST_RUN syscall with 284 bytes of crafted packet data, repeat=4, and BPF_F_TEST_RUN_ON_CPU flag to trigger the cross-cache free.cve-2026-31429-poc-only.c:66-78cve-2026-31429-poc-only.c:100-101
• Loops 50 additional BPF_PROG_TEST_RUN calls for reliability.cve-2026-31429-poc-only.c:105-106
• Instructs user to check dmesg for 'warn_free' to confirm vulnerability detection.cve-2026-31429-poc-only.c:108

Observables

Bpf Program

Payload withheldMinimal 3-instruction BPF program used to trigger the kernel bug via BPF_PROG_TEST_RUN.cve-2026-31429-poc-only.c:28-32

Syscall

Payload withheldThe PoC uses standard Linux BPF syscalls to load and run a BPF program, which is the documented trigger mechanism for the vulnerability.cve-2026-31429-poc-only.c:55-78

Mmap Setup

Payload withheldThese mmap calls set up memory mappings similar to Syzkaller's environment, which is a common practice in kernel fuzzing PoCs to ensure reliable reproduction of the bug.cve-2026-31429-poc-only.c:86-91

Classification basis

The primary artifact is a C program (cve-2026-23416-poc.c) that directly exercises the vulnerability by making syscalls to trigger a kernel warning. The README explicitly labels it as a 'Proof of Concept' and provides build/run instructions to reproduce the issue. This constitutes exploit code intended to exercise a vulnerability.

Requirements

• Linux kernel version 6.17 through 7.0-rc5 with CONFIG_DEBUG_VM enabled to observe the warning; unprivileged user access.README.md:15-17README.md:143-144

Observed behavior

• The PoC program forks child processes in a loop. Each child calls trigger(), which uses memfd_create, mmap, and mseal syscalls to create a specific VMA layout and then issues a second mseal call that triggers a kernel warning at mm/vma.c:830 due to a stale VMA end address.cve-2026-23416-poc.c:49-94cve-2026-23416-poc.c:108-127
• The parent process periodically checks dmesg for the triggered warning and prints a message indicating how many times the warning has been triggered.cve-2026-23416-poc.c:122-126

Observables

System Call

Payload withheldThe PoC invokes a shell pipeline to count kernel warnings, which is expected behavior for a kernel exploit PoC and does not constitute a backdoor.cve-2026-23416-poc.c:123-126

Classification basis

The code is a complete, compilable C program that actively sends a crafted network packet to a target. It is explicitly labeled as a 'proof of concept exploit' and 'Poc Exploit' in both the README and source code comments, and its purpose is to trigger the vulnerability, not merely detect it.

Requirements

• Target must be running rldns version 1.3 on a reachable network interface.README.md:4exploit.c:2
• Attacker must provide target IP address and port number as command-line arguments.exploit.c:31-34

Observed behavior

• Sends a hardcoded 16-byte UDP payload to the specified target IP and port.exploit.c:29exploit.c:46
• Reports success or failure of the send operation to stdout.exploit.c:48-52

Observables

Network Behavior

Payload withheldThe exploit.c main function creates a UDP socket and sends a hardcoded byte sequence to the target. This matches the described CVE-2026-27831 out-of-bounds read trigger.exploit.c:29exploit.c:46

Classification basis

The artifact is a technical analysis document (writeup) that explains the vulnerability, its root cause, and the exploitation methodology. It contains code snippets for illustration but does not provide a complete, self-contained exploit or scanner. The complete exploit code is stated to be in a separate repository.

Requirements

• Local unprivileged user access to a vulnerable Linux kernel (5.8 through 5.15.24)README.md:9

Observed behavior

• The writeup describes a four-step exploitation flow: 1) fill a pipe to set the PIPE_BUF_FLAG_CAN_MERGE flag, 2) drain the pipe, 3) use splice() to map a read-only file's page cache into the pipe, and 4) write to the pipe to overwrite the page cache, achieving privilege escalation.README.md:128-133
• The writeup provides code snippets for each step of the exploitation process, including filling the pipe, draining it, calling splice(), and writing the payload.README.md:147-178

Observables

External Reference

Payload withheldThe document references an external repository containing a complete exploit, but this content is not included in the evidence packet and is not analyzed.README.md:183