Rezy-Dev
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubRezy-Dev/CVE-2018-11235
Repository PoCStars: 0Created 2026-01-18ExploitCVE-2018-112352 files
Analysis
Technical assessment
Automated bash script that builds a malicious Git repository exploiting CVE-2018-11235. It creates a crafted .gitmodules file with directory traversal in the submodule name, sets up a post-checkout hook containing a payload, and serves the repository via Apache for victim cloning with --recurse-submodules to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2018-11235. The script builds a malicious Git repository that, when cloned with --recurse-submodules by a vulnerable Git version, executes a hardcoded payload (echo 'rce-poc-rezydev' > /exploited.txt) on the victim's machine. This is the documented exploit behavior for the stated CVE and does not include any concealed backdoor, credential theft, persistence, or unrelated payload targeting the person running the PoC.
Classification basis and observed behavior
Classification basis
The script builds and serves a malicious Git repository that, when cloned with --recurse-submodules by a vulnerable client, executes an attacker-supplied command via a crafted post-checkout hook. This is active exploitation code, not merely detection or analysis.
exploit.sh:2exploit.sh:23exploit.sh:80-85exploit.sh:88-100Requirements
- Attacker must run the script as root on a server with internet access to install Apache and build the malicious repository.
exploit.sh:3exploit.sh:10-14exploit.sh:30-33 - Victim must clone the malicious repository using 'git clone --recurse-submodules' with a vulnerable Git version (<= 2.17.0).
README.md:19exploit.sh:137-139
Observed behavior
- Installs and configures Apache2 web server if not present.
exploit.sh:28-44 - Creates a bare Git repository and clones it to a working directory.
exploit.sh:52-63 - Adds a submodule and moves its .git/modules directory to a fakegit path, then creates a malicious post-checkout hook script containing the payload 'payload withheld'.
exploit.sh:72-85 - Crafts .gitmodules with a submodule name containing directory traversal ('.../../fakegit/modules/evil') to redirect Git to the attacker-controlled hook.
exploit.sh:88-100 - Commits and pushes the malicious structure to the bare repository, then serves it via Apache.
exploit.sh:108-124 - Outputs instructions for the victim to clone the repository, triggering the post-checkout hook and executing the payload.
exploit.sh:131-142
Behaviors behind the backdoor verdict
Observables
- Payload
- Payload withheldThe payload executed on the victim's machine when the malicious repository is cloned. It is a benign proof-of-concept marker.
exploit.sh:23exploit.sh:80-83 - Exploit Mechanism
- Payload withheldThe script creates a submodule with a name containing '../' to achieve directory traversal, placing a malicious post-checkout hook outside the expected .git/modules directory.
exploit.sh:88-100
What the analysis did not establish
- Evidence is limited to the two text files in the repository snapshot; no runtime behavior or external dependencies were observed.
- The script contains a fallback mechanism (lines 91-100) that may indicate the primary rename method can fail, but the evidence does not confirm execution success.
- Only the two text files (README.md and exploit.sh) were reviewed; no binary or other files exist in the artifact.
- The script requires root privileges and installs Apache2, which modifies the system, but this is disclosed in the README and is part of the PoC setup, not a concealed backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubRezy-Dev/CVE-2018-6574
Repository PoCStars: 0Created 2026-01-16ExploitCVE-2018-65743 files
Analysis
Technical assessment
A Go source file that leverages cgo to pass the -fplugin= argument to the compiler, triggering CVE-2018-6574 for remote command execution during 'go get'.
Backdoor review
No backdoor observed in reviewed code
The supplied text evidence (main.go) is a minimal Go cgo program that loads a shared library (payload withheld) via a C compiler flag (payload withheld) and calls a function from it. This matches the documented CVE-2018-6574 proof-of-concept pattern. The text itself contains no concealed commands, credential theft, persistence mechanisms, or unrelated payloads. The binary payload withheld is present but was not analyzed per the evidence policy; its behavior is unknown. No backdoor behavior is observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact contains a cgo CFLAGS directive that injects payload withheld, which is the exact mechanism described in CVE-2018-6574 for achieving remote command execution during 'go get'. This is code intended to exercise the vulnerability, not merely detect it.
main.go:2Requirements
- Target must use a vulnerable Go version (before 1.8.7, 1.9.x before 1.9.4, or 1.10 pre-releases before 1.10rc2) that does not block -fplugin= arguments.
main.go:2 - A malicious shared library (payload withheld) must be present at the referenced path.
main.go:2
Observed behavior
- The source code includes a cgo directive that passes payload withheld to the C compiler, which would load and execute the shared library during compilation.
main.go:2 - The code defines C functions (bridge_int_func, fortytwo) and calls them from Go, demonstrating a functional cgo bridge that would also trigger the malicious plugin load.
main.go:3-18
Behaviors behind the backdoor verdict
Observables
- Compiler Flag
- Payload withheldThe cgo CFLAGS directive instructs the compiler to load a shared library, which is the mechanism described in CVE-2018-6574 for remote command execution during 'go get'.
main.go:2 - Binary File
- Payload withheldA shared library referenced by the compiler flag. Its contents were not analyzed; it could contain arbitrary code, but no evidence of backdoor behavior is present in the reviewed text.
main.go:2
What the analysis did not establish
- The malicious shared library payload withheld is present as a binary file and was not analyzed; its exact payload is unknown.
- Only one of three repository files was provided as text; the other text file was omitted, limiting full context.
- Binary file payload withheld (14992 bytes) was not analyzed; its behavior is unknown and could contain malicious code.
- One additional text file and one unclassified file were omitted from the evidence packet; their contents are unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubRezy-Dev/CVE-2023-35813
Repository PoCStars: 0Created 2025-11-30ScannerCVE-2023-358132 files
Analysis
Technical assessment
Python script that sends crafted HTTP POST requests to a Sitecore target to test for CVE-2023-35813 by attempting to manipulate HTTP response headers (Content-Type, Status Code, Location) and extract database connection strings. It does not execute arbitrary commands or establish a reverse shell; it only detects and reports exposure.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script for CVE-2023-35813. The script sends crafted HTTP requests to a user-supplied target to test for a Sitecore RCE vulnerability and extract connection strings. No backdoor, trojan, or deceptive behavior targeting the person running the PoC was observed. The script performs only the advertised vulnerability testing and does not contain concealed executable payloads, persistence mechanisms, or unrelated remote access.
Classification basis and observed behavior
Classification basis
The script's primary operation is to send crafted requests and check responses for indicators of vulnerability (header manipulation, connection string leakage). It does not contain code to execute arbitrary commands, drop a shell, or otherwise exploit the target beyond detection. The README and script description label it as a 'PoC', but its observable behavior is limited to scanning and validation.
exploit.py:1-6exploit.py:116-133exploit.py:415-472Requirements
- Target URL of a Sitecore instance
exploit.py:476
Observed behavior
- Sends POST requests with a ParseControl payload to inject a custom Content-Type header value and checks if the response Content-Type reflects the injected value.
exploit.py:135-168 - Sends POST requests to attempt to set the HTTP response status code to 302 and verifies the response status code.
exploit.py:170-202 - Sends POST requests to inject a redirect Location header and checks for the presence of the injected URL in the response Location header.
exploit.py:204-260 - Sends POST requests to extract core, master, and web database connection strings by reflecting them in the Content-Type header and parses the response for connection string indicators.
exploit.py:262-385 - Prints a summary of test results and declares the target vulnerable if any test succeeds, but does not perform any action beyond detection and reporting.
exploit.py:432-472
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe script sends HTTP POST requests to the target URL and may redirect to the InteractSH URL. These are expected behaviors for a PoC that tests a remote code execution vulnerability.
exploit.py:116-133exploit.py:211-212 - Credential Extraction
- Payload withheldThe script attempts to extract database connection strings (core, master, web) from the target's HTTP response headers. This is part of the advertised PoC functionality to demonstrate information disclosure.
exploit.py:262-303exploit.py:305-344exploit.py:346-385
What the analysis did not establish
- Evidence consists of two text files (README.md and exploit.py) from a single commit; no binary files, network captures, or execution logs are provided.
- The script's actual effectiveness or safety cannot be verified from static analysis alone.
- The review is limited to the supplied text files (README.md and exploit.py). No binary files were present or analyzed. The script's behavior depends on the user-supplied target URL, which is not part of the artifact itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.