BTtea Exploits and Proofs of Concept

Showing 3 PoCs on this page

GitHub

BTtea/CVE-2026-20841-PoC

Repository PoC140Created 2026-02-11ScannerCVE-2026-208414 files

507.3 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-13

Technical assessment

The artifact provides a reference to a potential trigger for CVE-2026-20841, a command injection vulnerability in Windows Notepad. It contains a link to a remote AppX installer and a local file execution link, but the author explicitly states it is unclear if this is the correct trigger method and provides it for reference only. The artifact does not contain any executable exploit code or a fully functional proof-of-concept; it merely demonstrates a potential attack vector for testing or validation purposes.

Backdoor review

Backdoor review undetermined

The supplied text files describe a PoC for CVE-2026-20841 (Windows Notepad RCE) but contain no executable code. The README states the trigger method is uncertain and references two unreadable image files. The PoC.md file contains a link to a remote .appx file and a local file execution link. Without the image content or the remote .appx file, the actual exploit behavior cannot be reviewed, and no backdoor or deceptive behavior is directly established.

ClassificationScanner

Model confidence90%

AuthenticationNot required

LanguagesMarkdown

Target softwareMicrosoft Windows Notepad

Attack typescommand injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a scanner because it provides a reference to a potential vulnerability trigger without containing executable exploit code. The author's disclaimer that the method is unverified and provided for reference indicates it is intended for testing or validation, not direct exploitation. The links serve as a demonstration of the attack vector rather than a fully weaponized exploit.

README.md:1PoC.md:2PoC.md:5

Requirements

Target must be running a vulnerable version of Windows Notepad (version < 11.2510).README.md:6

Observed behavior

The artifact provides a reference link that, if clicked, would attempt to install a remote AppX package via ms-appinstaller protocol.PoC.md:2
The artifact provides a reference link that, if clicked, would attempt to execute cmd.exe via a local file URI.PoC.md:5
The author states it is unclear whether the provided links are the correct trigger method and provides them for reference only.README.md:1

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url: Payload withheldA link in PoC.md that, if clicked, would attempt to install a remote application package. The content of the package is unknown.PoC.md:2
Url: Payload withheldA link in PoC.md that, if clicked, would attempt to execute the local command prompt. This is consistent with a local command execution PoC.PoC.md:5

Review boundaries

What the analysis did not establish

The evidence packet does not include the content of the two image files (poc_1.png, poc_2.png) referenced in README.md, which may contain additional details about the trigger method.
The evidence packet does not include the content of the two non-text files omitted from the analysis, which could contain executable code or further instructions.
The two image files (poc_1.png, poc_2.png) referenced in README.md are not included as text and cannot be reviewed.
The remote file 'https://evil/xxx.appx' referenced in PoC.md is not included and cannot be reviewed.
The README.md explicitly states uncertainty about the correct PoC trigger method.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub