machevalia
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubmachevalia/CVE-2024-0692-SolarWinds-SEM-RCE
Repository PoCStars: 0Created 2026-01-13ExploitCVE-2024-06922 files
Analysis
Technical assessment
A Python exploit for CVE-2024-0692 that targets SolarWinds Security Event Manager via AMF deserialization. It generates a malicious Java class for a reverse shell, hosts it on an HTTP server, constructs a C3P0 WrapperConnectionPoolDataSource AMF payload, sends it to the target, and provides an interactive shell handler.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a single Python script (CVE-2024-0692.py) and a README. The script implements a publicly documented exploit for CVE-2024-0692, a SolarWinds SEM AMF deserialization RCE. It generates a reverse shell payload, hosts it via HTTP, sends the AMF exploit, and provides an interactive shell handler. All behavior is consistent with the stated exploit purpose. No concealed backdoor, unrelated remote access, persistence, credential theft, or deceptive payload targeting the person running the PoC was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete, self-contained exploit script that generates and delivers a deserialization payload to achieve remote code execution and provides an interactive reverse shell handler. It does not merely detect or report a vulnerability; it actively exploits it.
CVE-2024-0692.py:1-550Requirements
- Java 8+ JDK (javac) to compile the malicious payload class
CVE-2024-0692.py:15 - Python 3.6+ with requests library
CVE-2024-0692.py:16-17 - Network connectivity from attacker to target and from target back to attacker's HTTP server and reverse shell listener
CVE-2024-0692.py:12
Observed behavior
- Compiles a Java class containing a reverse shell payload (bash and PowerShell variants)
CVE-2024-0692.py:171-228 - Starts an HTTP server to serve the compiled malicious class to the target
CVE-2024-0692.py:340-351 - Generates an AMF3 deserialization payload using the C3P0 WrapperConnectionPoolDataSource gadget chain
CVE-2024-0692.py:231-252 - Sends the AMF payload via HTTP POST to the target's /services/messagebroker/streamingamf endpoint
CVE-2024-0692.py:354-390 - Listens for and provides an interactive reverse shell session
CVE-2024-0692.py:58-168
Behaviors behind the backdoor verdict
Observables
- Reverse Shell Listener
- Payload withheldThis is the intended exploit behavior: receiving a reverse shell from the target after successful exploitation.
CVE-2024-0692.py:58-168 - Java Payload Generation
- Payload withheldStandard reverse shell payload for RCE exploitation; no hidden or unrelated commands.
CVE-2024-0692.py:171-228 - Http Server
- Payload withheldRequired for the C3P0 deserialization gadget to load the malicious class; serves only the expected class file.
CVE-2024-0692.py:315-351 - Amf Payload Construction
- Payload withheldImplements the documented CVE-2024-0692 exploit technique; no extraneous payload data.
CVE-2024-0692.py:231-293 - Author Contact
- Payload withheldAuthor identification in comments and banner; not a backdoor indicator.
CVE-2024-0692.py:9CVE-2024-0692.py:416
What the analysis did not establish
- The evidence is limited to the source code of the exploit script and a README; no execution or runtime behavior was observed.
- The C3P0 payload generation function (build_c3p0_hex_payload) appears incomplete or simplified, as it uses a hardcoded JNDI Reference hex template that does not incorporate the provided codebase_url and classname, which may affect reliability.
- The exploit requires the target to be able to reach the attacker's HTTP server to load the malicious class, which may not be possible in all network configurations.
- Only the two text files (CVE-2024-0692.py and README.md) were reviewed; no binary files were present in the evidence.
- The review does not assess whether the exploit works as claimed or is safe to execute against authorized targets.
- The Java payload is generated at runtime and compiled locally; its content is determined by user-supplied arguments and is not reviewed as a static artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubmachevalia/CVE-2025-14733
Repository PoCStars: 0Created 2025-12-23ScannerCVE-2025-147332 files
Analysis
Technical assessment
A Python-based network scanner that sends IKEv2 IKE_SA_INIT requests to detect WatchGuard Firebox appliances and identify versions potentially vulnerable to CVE-2025-14733. It parses vendor ID payloads to extract version and build numbers, then compares them against known affected ranges. The tool does not exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python IKEv2 scanner and a README. The scanner sends standard IKE_SA_INIT probes, parses responses for WatchGuard vendor IDs and version strings, and compares versions against the CVE-2025-14733 advisory ranges. No backdoor, concealed payload, persistence, credential theft, or unrelated remote access behavior is present. The code performs only the documented scanning and version-checking operations.
Classification basis and observed behavior
Classification basis
The artifact is a scanner. It sends IKEv2 probes to detect WatchGuard devices and checks version strings against known affected ranges without attempting to trigger the out-of-bounds write vulnerability. The README explicitly states 'This tool performs safe version detection through standard IKEv2 negotiation. It does not attempt exploitation.' The code contains no exploit payloads, memory corruption triggers, or shellcode.
README.md:5CVE-2025-14733-Scanner.py:1-493Requirements
- Target must expose IKEv2 service on UDP port 500
CVE-2025-14733-Scanner.py:306 - Target must respond to IKE_SA_INIT with a valid IKEv2 response containing vendor ID payloads
CVE-2025-14733-Scanner.py:115-224
Observed behavior
- Sends a crafted IKE_SA_INIT request packet to the target on UDP port 500
CVE-2025-14733-Scanner.py:328-329 - Parses the IKEv2 response to extract vendor ID strings and identifies WatchGuard devices by looking for 'WatchGuard' or 'Firebox' substrings or base64-encoded version strings
CVE-2025-14733-Scanner.py:163-219 - Compares the extracted version against known affected ranges (11.10.2-11.12.4_Update1, 12.0-12.11.5, 2025.1-2025.1.3) to determine if the target is potentially vulnerable
CVE-2025-14733-Scanner.py:254-302 - Outputs scan results to console and optionally to a JSON file, labeling hosts as VULNERABLE, NOT_VULNERABLE, or UNKNOWN_VERSION
CVE-2025-14733-Scanner.py:465-489
Behaviors behind the backdoor verdict
Observables
- Network Probe
- Payload withheldThe scanner sends a single IKE_SA_INIT request per target to elicit a version-disclosing response; this is the expected behavior for a detection tool.
CVE-2025-14733-Scanner.py:67-112CVE-2025-14733-Scanner.py:306-329 - Version Parsing
- Payload withheldThe tool parses IKEv2 Vendor ID payloads to identify WatchGuard devices and extract Fireware OS version and build numbers for vulnerability comparison.
CVE-2025-14733-Scanner.py:163-219 - Vulnerability Check
- Payload withheldThe check_vulnerable_version function implements the exact version ranges from the WatchGuard advisory without any exploitation attempt.
CVE-2025-14733-Scanner.py:254-302
What the analysis did not establish
- Analysis based solely on static source code review; code was not executed.
- Only the two text files (scanner script and README) were provided; no binary or network capture evidence was included.
- Only the two text files (CVE-2025-14733-Scanner.py and README.md) were provided; no other files exist in the repository snapshot.
- Binary content is absent from the evidence; the analysis is limited to the supplied readable text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.