tr3m0x
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubtr3m0x/CVE-2021-41773
Repository PoCStars: 0Created 2026-07-27WriteupCVE-2021-417733 files
Analysis
Technical assessment
The artifact is a technical writeup explaining the CVE-2021-41773 path traversal vulnerability in Apache HTTP Server 2.4.49. It includes a root cause analysis, a vulnerable code snippet, a processing flow diagram, and instructions for setting up a lab environment and sending a curl request to demonstrate the vulnerability. No executable exploit or scanner code is provided.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a Dockerfile and a Readme.md documenting the CVE-2021-41773 path traversal vulnerability. The Dockerfile builds a vulnerable Apache 2.4.49 image and copies a configuration file (not included in the reviewed text). The Readme.md provides a technical explanation, root cause analysis, and a curl command to demonstrate the vulnerability. No backdoor, deceptive payload, or concealed executable behavior is present in the reviewed evidence.
Classification basis and observed behavior
Classification basis
The artifact is a Markdown document containing a detailed technical analysis of CVE-2021-41773, including root cause, vulnerable code, and exploitation steps. It does not contain any executable code that automatically exploits or scans for the vulnerability; the provided curl command is a manual example for demonstration purposes. The classifier identified no PoC code.
Readme.md:1-307Dockerfile:1-5Requirements
- Apache HTTP Server 2.4.49 with Alias-like directives configured
Readme.md:5-7 - Docker to build and run the vulnerable environment
Readme.md:223-234
Observed behavior
- Describes how an attacker can use encoded dot sequences (e.g., .%2e) to bypass path traversal checks and read arbitrary files like /etc/passwd
Readme.md:15-43 - Provides a curl command to send a malicious request to a locally running vulnerable server
Readme.md:243-245
Behaviors behind the backdoor verdict
Observables
- Vulnerability Documentation
- Payload withheldThe Readme.md explains the vulnerability, provides a PoC curl command, and discusses canonicalization issues. This is standard educational/exploit documentation.
Readme.md:1-307 - Docker Build Instruction
- Payload withheldThe Dockerfile builds a container with the vulnerable Apache version for testing the PoC.
Dockerfile:1-5
What the analysis did not establish
- One file (vulnerable.conf) is omitted from the evidence, so the exact Alias configuration is not visible.
- The analysis is based solely on the provided text; no dynamic testing was performed.
- The file 'vulnerable.conf' referenced in the Dockerfile is not included in the reviewed text evidence; its content is unknown.
- Binary files were not analyzed per the evidence envelope policy; no binaries were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtr3m0x/CVE-2019-25065-poc
Repository PoCStars: 0Created 2026-03-26ExploitCVE-2019-250652 files
Analysis
Technical assessment
A Python script that exploits CVE-2019-25065, an OS command injection vulnerability in OpenNetAdmin <=18.1.1, by sending a crafted POST request to execute arbitrary commands on the target.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a Python script that exploits CVE-2019-25065 (OS command injection in OpenNetAdmin) and a short README. The script sends crafted POST requests to a user-supplied URL to execute an arbitrary command provided by the user. All behavior is consistent with a standard public exploit: it accepts a target URL and command, sends the injection payload, and prints the output. No concealed executable behavior, persistence, credential theft, unrelated remote access, or deceptive payloads were observed.
Classification basis and observed behavior
Classification basis
The script constructs and sends a malicious HTTP request that injects an OS command into the 'ip' parameter, which is a classic exploit technique. It includes a function named 'exploit' that executes the payload and returns the output, demonstrating active exploitation rather than mere detection.
exploit.py:28-50Readme.md:3Requirements
- Target running OpenNetAdmin <=18.1.1 with the vulnerable endpoint accessible.
Readme.md:3 - Network access to the target URL.
exploit.py:18
Observed behavior
- Sends a POST request with a command injection payload in the 'xajaxargs[]' parameter to execute an arbitrary OS command.
exploit.py:30-37 - Extracts and prints the command output from the HTTP response using a unique separator.
exploit.py:42-46 - Optionally retrieves the OpenNetAdmin version by querying the app_about module.
exploit.py:10-23
Behaviors behind the backdoor verdict
Observables
- Command Injection Payload
- Payload withheldThe exploit constructs an OS command injection payload using a user-supplied command, delimited by a UUID separator to extract output. This is the expected exploit mechanism for CVE-2019-25065.
exploit.py:34 - Network Request
- Payload withheldThe script sends HTTP POST requests to the target URL with the injection payload. This is the standard delivery method for the exploit.
exploit.py:40
What the analysis did not establish
- The evidence does not include any authentication mechanism; the exploit appears to work without credentials, but the CVE context lists 'PR:L' (privileges required: low), which may indicate a discrepancy or that the exploit bypasses authentication.
- Only the two text files (Readme.md, exploit.py) were reviewed; no binary files were present.
- The behavior of the Python standard library and the 'requests' third-party library is assumed to be benign; their source code was not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtr3m0x/CVE-2025-6019
Repository PoCStars: 0Created 2026-02-13ExploitCVE-2025-60193 files
Analysis
Technical assessment
A bash script that exploits CVE-2025-6019 by creating a loop device for a crafted XFS image, triggering a UDisks2 filesystem resize via D-Bus, and then executing a SUID-root shell from the mounted image to achieve local privilege escalation.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a bash exploit script for CVE-2025-6019. The script performs a local privilege escalation by creating a loop device, triggering a UDisks2 filesystem resize, and executing a pre-staged SUID rootbash. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The behavior is consistent with the stated exploit goal.
Classification basis and observed behavior
Classification basis
The script actively performs the steps to exploit the vulnerability: it sets up a loop device, triggers the vulnerable resize operation via D-Bus, and then executes a SUID-root shell to escalate privileges. This is exploitation, not just detection or scanning.
exploit.sh:32-64Readme.md:3Requirements
- An allow_active Polkit session (e.g., physical console login)
Readme.md:13 - A crafted XFS filesystem image containing a SUID-root shell, generated by payload withheld
Readme.md:14 - Required tools: mkfs.xfs, udisksctl, gdbus, loginctl
Readme.md:12
Observed behavior
- Verifies the user has an active session using loginctl
exploit.sh:9-25 - Kills the gvfs-udisks2-volume-monitor process
exploit.sh:29 - Creates a loop device for the provided XFS image using udisksctl
exploit.sh:32-36 - Starts a background process that repeatedly attempts to execute a SUID-root shell from /tmp/blockdev* to keep the filesystem busy
exploit.sh:40-43 - Triggers the UDisks2 filesystem resize operation via a D-Bus call to org.freedesktop.UDisks2.Filesystem.Resize
exploit.sh:46-49 - Locates and executes the SUID-root shell (rootbash) from the /tmp/blockdev* directory to gain root privileges
exploit.sh:55-64
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal exploit behavior for CVE-2025-6019 as described in the README.
exploit.sh:32exploit.sh:47-49exploit.sh:62-64 - File Reference
- Payload withheldThe README references a script to build the XFS payload image, but this file was not included in the supplied text evidence.
Readme.md:7
What the analysis did not establish
- The payload withheld script, which builds the malicious XFS image, is not included in the selected text evidence.
- The evidence does not include the SUID-root binary (rootbash) or the crafted XFS image itself.
- The analysis is based solely on static review of the provided source code; the exploit was not executed.
- The payload creation script payload withheld was not included in the supplied text evidence.
- One file (unclassified, 1435 bytes) was omitted from the text evidence and not analyzed.
- Binary content was not analyzed per the evidence envelope policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.