ben-slates
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubben-slates/CVE-2024-37054
Repository PoCStars: 5Created 2026-05-17ExploitCVE-2024-370543 files
Analysis
Technical assessment
A Python exploit for CVE-2024-37054 that achieves remote code execution on MLflow Tracking Server by overwriting a model's python_model.pkl artifact with a malicious pickle payload and triggering deserialization via a prediction request.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python proof-of-concept exploit (poc.py) and its documentation (readme.md) for CVE-2024-37054, a pickle deserialization vulnerability in MLflow. The code implements a documented exploit chain: authenticate, upload training data, retrieve a run ID, overwrite a model artifact with a malicious pickle payload, and trigger deserialization to execute a user-supplied command or reverse shell. All behavior is consistent with the stated purpose of demonstrating the CVE. No concealed, deceptive, or unrelated harmful behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, functional Python script (poc.py) that implements a multi-step exploit chain to achieve remote code execution on a vulnerable MLflow server. The script generates a malicious pickle payload, uploads it to overwrite a model artifact, and triggers deserialization to execute arbitrary commands. The README explicitly describes it as a 'Proof-of-concept exploit'.
poc.py:1-644readme.md:9Requirements
- Network access to the MLflow Tracking Server
readme.md:34 - Valid MLflow credentials (default or otherwise)
readme.md:35 - Write access to artifacts (granted to all authenticated users)
readme.md:36
Observed behavior
- Authenticates to the target application using provided credentials
poc.py:319-357 - Uploads a training CSV to register a new MLflow model version
poc.py:359-403 - Retrieves the run_id from the MLflow Tracking API
poc.py:405-460 - Overwrites the python_model.pkl artifact with a malicious pickle payload via HTTP PUT
poc.py:462-498 - Triggers model deserialization by sending a prediction request, causing the pickle payload to execute
poc.py:500-529 - The pickle payload uses os.system() to execute a reverse shell or custom command
poc.py:286-317
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThis is the documented exploit flow for CVE-2024-37054 and matches the vulnerability description.
poc.py:198-211poc.py:531-597 - Payload Generation
- Payload withheldThis is the standard technique for pickle deserialization RCE and is explicitly described in the documentation.
poc.py:286-317readme.md:46-51 - Network Activity
- Payload withheldAll network activity is directed at the user-specified targets and is necessary for the exploit.
poc.py:319-357poc.py:359-403poc.py:405-460poc.py:462-498poc.py:500-529
What the analysis did not establish
- One file (LICENSE) was omitted from the text evidence due to size budget; it is unlikely to contain exploit logic.
- The evidence does not include any binary or non-text files.
- One file (LICENSE) was omitted from the text evidence; its content is not reviewed, but it is typically a standard license file and unlikely to contain executable behavior.
- Binary content was not present; the artifact consists solely of text files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubben-slates/CVE-2026-31431-Exploit
Repository PoCStars: 1Created 2026-05-01ExploitCVE-2026-314314 files
Analysis
Technical assessment
A Python script that exploits CVE-2026-31431 in the Linux kernel's algif_aead module to corrupt the page cache of payload withheld, achieving local privilege escalation to root.
Backdoor review
No backdoor observed in reviewed code
The exploit.py script performs the disclosed local privilege escalation (LPE) against the Linux kernel CVE-2026-31431 vulnerability. It opens payload withheld, uses the algif_aead socket to corrupt its page-cache view with a decompressed payload, and then executes 'su' to gain root. The behavior matches the documented exploit technique in the readme.md. No concealed, unrelated, or misrepresented harmful actions were found.
Classification basis and observed behavior
Classification basis
The artifact contains a Python script (exploit.py) that actively corrupts the page cache of payload withheld and then executes it to gain root privileges, which is code intended to exercise a vulnerability.
exploit.py:1-10readme.md:3Requirements
- Local unprivileged user access to a vulnerable Linux kernel with algif_aead module loaded.
readme.md:7 - Target file payload withheld must exist and be readable.
exploit.py:8
Observed behavior
- Opens payload withheld for reading and splices its page-cache pages into an AF_ALG AEAD socket to trigger a scratch write corruption.
exploit.py:5exploit.py:8 - Iterates over a compressed payload, calling the corruption function c() for each 4-byte chunk to overwrite the in-memory copy of payload withheld.
exploit.py:8-9 - Executes 'su' after corruption to spawn a root shell.
exploit.py:10
Behaviors behind the backdoor verdict
Observables
- File Path
- Payload withheldTarget file for page-cache corruption, consistent with the disclosed LPE goal.
exploit.py:8 - Command Execution
- Payload withheldExecutes 'su' to gain root privileges after corrupting its page-cache view, which is the stated purpose of the exploit.
exploit.py:10 - Encoded Payload
- Payload withheldDecompressed payload is written to the corrupted page-cache of payload withheld. This is the exploit's payload delivery mechanism.
exploit.py:8
What the analysis did not establish
- Only the exploit.py and readme.md files were provided as text; two other files (LICENSE, brand.md) were omitted, but they are not required for classification.
- The compressed payload in exploit.py is opaque and was not decompressed or analyzed.
- The decompressed payload (zlib data) is not inspected, but its use is confined to the disclosed page-cache corruption of the local target binary.
- Two files (LICENSE, brand.md) were omitted from the text evidence, but they are non-executable metadata/documentation files and are not expected to contain backdoor logic.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.