whyuhurtz

GitHub · Repository owner · Source ID 78311798
Source profile

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

GitHub

whyuhurtz/wongpress

Repository PoC0Created 2026-05-29WriteupCVE-2024-29510CVE-2024-296118 files

108.3 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a real-case exploitation chain combining CVE-2024-2961 (glibc buffer overflow) and CVE-2024-29510 (Ghostscript format string) to achieve RCE on an Ubuntu server. It provides step-by-step instructions for generating and delivering a Metasploit exploit, but the repository itself contains only documentation and no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of two markdown files: a README placeholder and an exploit guide for CVE-2024-29510. The guide instructs the user to generate a Metasploit payload and upload it to a WordPress endpoint. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text. The instructions describe a standard exploit workflow against a stated target, which is not backdoor behavior.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
Languagesmarkdown
Target softwareGhostscriptglibcUbuntu Server
Attack typesremote code executionformat stringbuffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a writeup because it provides a substantive technical analysis and step-by-step instructions for exploiting CVE-2024-29510, but does not contain any executable exploit or scanner code within the repository itself. The files are Markdown documentation describing how to use external tools (Metasploit) to perform the attack.

README.md:1-28exploit/cve-2024-29510.md:1-47

Requirements

  • Metasploit Framework is required to generate the exploit PostScript file.exploit/cve-2024-29510.md:5
  • A target server running a WordPress plugin that converts PostScript to images via Ghostscript is implied.exploit/cve-2024-29510.md:43-46

Observed behavior

  • The writeup instructs the user to generate a malicious PostScript file using a Metasploit module.exploit/cve-2024-29510.md:9-24
  • The writeup instructs the user to start a Metasploit handler to receive a reverse shell.exploit/cve-2024-29510.md:28-38
  • The writeup instructs the user to upload the generated PostScript file to a target WordPress endpoint via curl.exploit/cve-2024-29510.md:42-46
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ip Address
Payload withheldAttacker-controlled LHOST and FETCH_SRVHOST used in Metasploit payload generation and listener setup.exploit/cve-2024-29510.md:13exploit/cve-2024-29510.md:17exploit/cve-2024-29510.md:32exploit/cve-2024-29510.md:34
Ip Address
Payload withheldTarget WordPress server address used in the curl upload command.exploit/cve-2024-29510.md:43
Url
Payload withheldWordPress AJAX endpoint targeted for uploading the malicious PostScript file.exploit/cve-2024-29510.md:43
Filename
Payload withheldName of the fetched payload file written to /tmp on the target.exploit/cve-2024-29510.md:19
Review boundaries

What the analysis did not establish

  • Only 2 of 18 text files were included in the evidence packet; the remaining 16 files (109,417 bytes) were omitted and not analyzed.
  • The evidence packet reports complete_artifact_coverage as false, meaning the full repository content was not provided.
  • The README.md file contains placeholder text ('*soon*') for most sections, indicating the writeup is incomplete.
  • Only 2 of 18 text files in the repository were included in the evidence; the remaining 16 files were omitted and their contents are unknown.
  • No binary files were identified, but any non-text content in the repository would not have been analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.