g0thamRabb1t
Source-scoped identity with 6 associated PoCs and 6 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
GitHubg0thamRabb1t/CVE-2026-48908-joomla-sp-page-builder-detection
Repository PoCStars: 0Created 2026-07-09Not analyzedCVE-2026-489089 files
GitHubg0thamRabb1t/CVE-2026-48282-coldfusion-rds-detection
Repository PoCStars: 0Created 2026-07-07Not analyzedCVE-2026-482829 files
GitHubg0thamRabb1t/CVE-2026-46331-pedit-COW-detection
Repository PoCStars: 0Created 2026-06-30Not analyzedCVE-2026-463313 files
GitHubg0thamRabb1t/CVE-2026-48907-Joomla-JCE-detection
Repository PoCStars: 1Created 2026-06-18WriteupCVE-2026-4890713 files
Analysis
Technical assessment
A defensive validation report and SOC detection guide for CVE-2026-48907. It documents a controlled lab test, observed telemetry, and detection rules, but contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied text files (README.md and a Sigma rule) document a defensive validation of CVE-2026-48907. They describe lab observations, detection logic, and hardening guidance. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The artifact is a writeup. It contains a detailed technical analysis of CVE-2026-48907, including lab observations, telemetry, and detection guidance. It explicitly states it 'does not contain exploit code' (README.md line 336) and provides no executable exploit or scanner. The included Sigma rule is a detection signature, not a scanner.
README.md:336README.md:1-9Requirements
- Target must run JCE version <= 2.9.99.4
README.md:3 - Attacker must be able to send HTTP requests to the Joomla instance
README.md:98-108
Observed behavior
- Describes an attack chain: JCE version discovery, POST to JCE component, PHP webshell written to /tmp, HTTP request to webshell, command execution as www-data
README.md:97-109 - Provides observed HTTP sequence from Apache access.log showing GET/POST requests and webshell interaction
README.md:115-128 - Lists filesystem artifacts (webshell files) created in Joomla tmp directory
README.md:159-162 - Provides Sigma detection rules for webserver logs
rules/sigma/joomla_jce_component_exploit_attempt.yml:1-22
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldExternal reference to a public PoC repository; not part of the reviewed artifact's own behavior.
README.md:31 - File Path
- Payload withheldBinary PDF report flagged as uninspected; its content is not reviewed.
README.md:13 - File Path
- Payload withheldBinary PDF report flagged as uninspected; its content is not reviewed.
README.md:14
What the analysis did not establish
- Two binary PDF reports and other binary files were not analyzed; their content could contain additional details not reflected here.
- The analysis is based solely on the supplied text files; no code was executed or verified.
- Two binary PDF reports (Joomla_JCE_CVE-2026-48907_POC_EN.pdf, Joomla_JCE_CVE-2026-48907_POC_PL.pdf) and other binary assets (screenshots, DOCX files) were not inspected. Their content could differ from the text summary.
- The review covers only the two text files supplied in the evidence packet; the full repository contains additional files that were not provided.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubg0thamRabb1t/CVE-2026-43284-dirtyfrag-detection
Repository PoCStars: 0Created 2026-06-11WriteupCVE-2026-4328432 files
Analysis
Technical assessment
The repository is a technical writeup documenting a controlled lab validation of the public DirtyFrag PoC for CVE-2026-43284. It describes the test environment, observed auditd events, and provides SOC detection logic and SIEM correlation rules. It does not contain exploit or scanner code; the README states the focus is on documenting audit log visibility, not providing an exploitation guide.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (README.md and generate-system-info-table.sh) are documentation and a system information collection script. They describe a CVE-2026-43284 PoC validation, auditd detection logic, and SOC recommendations. No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied text.
Classification basis and observed behavior
Classification basis
The artifact is a writeup because it provides substantive technical analysis of CVE-2026-43284 exploitation visibility in audit logs, including a reconstructed event chain and detection logic, without containing any exploit or scanner code. The README explicitly states the focus is on documenting audit log events, not providing an exploitation guide.
README.md:5README.md:89-129Requirements
- Local unprivileged user access to a vulnerable Linux kernel (4.11 through unpatched versions) with ESP/IPsec modules available.
README.md:15-17
Observed behavior
- The README describes a test where a normal user executed a PoC (./exp) and obtained a root shell, confirmed via whoami and id.
README.md:49 - The artifact provides auditd detection logic, including a reconstructed event chain and an example SIEM correlation rule, but does not include the PoC code itself.
README.md:89-129
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldExternal reference to a public PoC repository; not part of the reviewed artifact code.
README.md:25
What the analysis did not establish
- Two binary PDF reports (reports/DirtyFrag_CVE-2026-43284_EN.pdf, reports/DirtyFrag_CVE-2026-43284_PL.pdf) were not analyzed; their content could contain additional technical details or code.
- The evidence packet reports complete_artifact_coverage as false, indicating not all repository files were inspected.
- The actual PoC exploit code (./exp) referenced in the README is not present in the supplied text files.
- Two binary PDF files (reports/DirtyFrag_CVE-2026-43284_EN.pdf, reports/DirtyFrag_CVE-2026-43284_PL.pdf) and 21 other files were not inspected; their content could contain malicious payloads not visible in the supplied text.
- The artifact references an external PoC repository (payload withheld) which was not reviewed; the verdict covers only the supplied evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.