aramosf
Source-scoped identity with 4 associated PoCs and 4 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
GitHubaramosf/CVE-2026-24031
Repository PoCStars: 0Created 2026-08-12ExploitCVE-2026-2403114 files
Analysis
Technical assessment
A Python 3 script that performs an unauthenticated SQL injection authentication bypass against Dovecot IMAP/POP3 services. It sends crafted usernames containing UNION SELECT payloads to log in as any user without knowing the real password, and includes a detection phase for the vulnerable no-escape condition.
Backdoor review
No backdoor observed in reviewed code
The PoC is a self-contained Python 3 script that exploits CVE-2026-24031, a SQL injection in Dovecot's SQL-based authentication. The code connects to a user-supplied target, sends crafted IMAP/POP3 authentication payloads, and reports success or failure. All behavior is consistent with the disclosed exploit: no hidden payloads, unauthorized data exfiltration, or concealed persistence mechanisms are present. The script uses only standard library modules and does not download or execute external code.
Classification basis and observed behavior
Classification basis
The Python script actively sends SQL injection payloads over the network to bypass authentication and log in as an arbitrary user, which constitutes exploitation, not merely detection or scanning.
cve-2026-24031-poc.py:196-217README.md:5-9Requirements
- Dovecot 2.4.0 or 3.1.0 with SQL passdb and auth_username_chars set to empty
README.md:20-22 - Network reachability to the IMAP/POP3/ManageSieve service
README.md:76
Observed behavior
- Connects to a target IMAP or POP3 service and sends an AUTHENTICATE PLAIN command with a crafted username containing a SQL UNION SELECT payload to override the password column for a victim user
cve-2026-24031-poc.py:64-72cve-2026-24031-poc.py:119-128 - Sends a detection payload (' OR '1'='1' -- ) to fingerprint the no-escape condition by checking for a 'temporary failure' response
cve-2026-24031-poc.py:75-77cve-2026-24031-poc.py:226-237 - Reports successful authentication bypass when the server returns an OK response for the injected credentials
cve-2026-24031-poc.py:247-254
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe script connects to a target specified by the operator via command-line arguments (lines 172-173 of cve-2026-24031-poc.py). This is the disclosed exploit target.
cve-2026-24031-poc.py:172-173 - Exploit Payload
- Payload withheldThe script constructs SQL injection payloads (lines 64-77) to bypass Dovecot authentication, matching the described vulnerability.
cve-2026-24031-poc.py:64-77
What the analysis did not establish
- Only the README.md and cve-2026-24031-poc.py files were provided as text; 11 other text files and 1 non-text file were omitted from the evidence packet.
- The evidence packet reports complete_artifact_coverage as false, indicating not all repository files were analyzed.
- The repository contains 12 additional files (including binary assets and lab configuration) that were not provided as text. Their content was not reviewed, but the core exploit logic is fully contained in the reviewed Python script.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubaramosf/CVE-2026-68398
Repository PoCStars: 0Created 2026-08-12ExploitCVE-2026-6839814 files
Analysis
Technical assessment
A local privilege escalation exploit for CVE-2026-68398 targeting Ubuntu 22.04 with kernel 5.15.0-187-generic. It exploits a use-after-free race condition in the PPPoL2TP receive path by racing channel creation/destruction with user-key payloads to reclaim freed memory, forge credentials, and install a SUID root helper.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, Makefile, and exploit.c source code for a local privilege escalation exploit targeting CVE-2026-68398. The code performs kernel heap manipulation, race condition exploitation, and credential forging to gain root privileges, which is the expected behavior of a PoC exploit for this vulnerability. No concealed backdoor, unrelated payload, or deceptive operator-directed harm was observed. The exploit installs a temporary SUID helper to transition to root, which is a standard technique for converting kernel-level credential changes into a persistent process with elevated privileges, and is fully disclosed in the README and source code.
Classification basis and observed behavior
Classification basis
The artifact contains complete, compilable C source code (exploit.c) that exercises the CVE-2026-68398 vulnerability to achieve local privilege escalation from an unprivileged user to root. The README documents a successful end-to-end exploitation chain, and the code includes all stages: race triggering, heap spraying, pointer leaking, credential forgery, and SUID helper installation. This is an exploit, not a scanner or writeup.
exploit.c:1-906README.md:1-223Requirements
- Target must be Ubuntu 22.04 with exact kernel release 5.15.0-187-generic.
exploit.c:644-650 - KASLR must be enabled; the exploit includes a prefetch-based KASLR bypass that requires RDTSCP and KPTI inactive.
README.md:101-108 - The l2tp_ppp kernel module must be available (autoloaded by the exploit).
README.md:81-86 - The user must be able to create PPPoL2TP sockets and user keys.
exploit.c:151-172exploit.c:407-408
Observed behavior
- Creates multiple threads that repeatedly create and close PPPoL2TP channels while sending L2TPv2/PPP frames to trigger the UAF race.
exploit.c:392-486 - Uses user-key payloads to reclaim the freed struct channel and control its skb queue and waitqueue fields.
exploit.c:451-458 - Leaks kernel heap pointers (skb, key object) through the readable key payload and /proc/sys/kernel/core_pattern.
exploit.c:729-760 - Constructs a fake credential structure inside a key payload, including UID 0, full capabilities, and valid init namespace pointers.
exploit.c:188-219 - Injects a fake AppArmor credential blob pointer and an unconfined label into the forged credential.
exploit.c:817-888 - Triggers override_creds() via a crafted waitqueue callback to gain root privileges, then copies /proc/self/exe to a SUID root helper and executes it to obtain persistent root.
exploit.c:894-905exploit.c:258-340
Behaviors behind the backdoor verdict
Observables
- Temporary Suid Helper
- Payload withheldThe exploit creates a temporary SUID root copy of itself to transition from kernel-level credential override to a user-space root process. This is a disclosed, necessary step for the exploit to function and is not a backdoor.
exploit.c:258-318exploit.c:894-905README.md:126-134 - Kernel Credential Forgery
- Payload withheldThe exploit forges a kernel credential structure to gain root privileges. This is the core mechanism of the privilege escalation and is consistent with the described vulnerability.
exploit.c:188-219
What the analysis did not establish
- The evidence includes only three text files (Makefile, README.md, exploit.c) out of 14 total files; 10 files are unclassified and one is non-text media, so the full repository content is not available for analysis.
- The exploit is build-specific and targets only one exact Ubuntu kernel build (5.15.0-187-generic); it is not a generic scanner or detector.
- The KASLR bypass component (kaslr_prefetch.c) is referenced but its source code is not included in the provided evidence.
- 10 text files and 1 non-text media file (assets/CVE-2026-68398.gif) were omitted from the evidence packet and not reviewed.
- The binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED; no binary files were inspected.
- The review is limited to static source code analysis; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubaramosf/CVE-2026-68138
Repository PoCStars: 6Created 2026-08-11ExploitCVE-2026-6813820 files
Analysis
Technical assessment
The artifact is a local privilege escalation exploit for CVE-2026-68138, a race condition in the Linux kernel's qdisc rate-table code. It uses a multi-stage technique involving a qdisc race, classic BPF heap spray, pipe leak, and page-cache overwrite to execute code as root in the initial user namespace.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and two C source files implementing a local privilege escalation exploit for CVE-2026-68138. The code performs kernel heap manipulation, race condition triggering, and overwrites /sbin/modprobe to gain root. All behavior is consistent with the stated exploit goal and no concealed backdoor, unrelated payload, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The artifact contains complete, compilable C source code that implements a multi-stage local privilege escalation attack. The code actively triggers a kernel race condition, performs heap manipulation, leaks kernel pointers, overwrites kernel memory, and executes a root shell. This is the definition of an exploit.
exploit.c:1-959README.md:5-8Requirements
- Unprivileged user namespaces and network namespaces enabled (CONFIG_USER_NS=y, CONFIG_NET_NS=y)
README.md:100 - Specific kernel configuration options enabled (CONFIG_NET_CLS, CONFIG_NET_CLS_FLOWER, CONFIG_NET_CLS_ACT, CONFIG_NET_ACT_POLICE, CONFIG_TMPFS_XATTR, CONFIG_MODULES)
README.md:102-106 - Memory cgroup accounting disabled (CONFIG_MEMCG=n) for the main PoC
README.md:107-108 - Per-process file-descriptor limit of at least 4096
README.md:109 - Disposable VM with approximately 5 GiB of RAM
README.md:110
Observed behavior
- Triggers a race condition on the global qdisc_rtab_list by sending concurrent RTM_NEWTFILTER netlink requests from multiple threads in separate network namespaces.
exploit.c:429-507 - Sprays the kmalloc-2k cache with classic BPF filter programs to reclaim a freed qdisc_rate_table object, creating an aliased memory region.
exploit.c:509-527 - Uses SO_GET_FILTER to detect the alias and then closes one socket to free the buffer, reclaiming it with pipe rings to leak kernel pointers (page and ops).
exploit.c:632-650 - Closes the second socket and reclaims the pipe ring with simple_xattr objects, forging a pipe_buffer with PIPE_BUF_FLAG_CAN_MERGE set.
exploit.c:664-690 - Writes attacker-controlled shellcode to the page-cache page of /sbin/modprobe via the dangling pipe write.
exploit.c:692-719 - Triggers execution of the overwritten /sbin/modprobe as root in the initial namespace by creating a socket with an unsupported protocol, which causes the kernel to request the missing module.
exploit.c:721-758
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented exploitation technique for CVE-2026-68138 and is not a backdoor.
exploit.c:692-719exploit.c:105-134 - Exploit Behavior
- Payload withheldThis is the documented vulnerability trigger and is not a backdoor.
exploit.c:429-507 - Exploit Behavior
- Payload withheldThese are standard kernel exploitation primitives and are not a backdoor.
exploit.c:509-527exploit.c:596-650
What the analysis did not establish
- The evidence packet includes only three text files (README.md, exploit.c, ubuntu/exploit-5.15.0-187.c) out of 20 total files in the repository. The remaining 17 files, including build scripts, configuration fragments, and documentation, are not provided.
- The analysis is based solely on static source code review. The code was not executed, and its effectiveness or reliability cannot be confirmed from the evidence alone.
- The exploit targets a specific kernel version and configuration. Its behavior on other systems is not represented in the evidence.
- 17 files in the repository were not provided as text and were not reviewed. The inventory indicates 1 non-text media file (likely the GIF screenshot) and 16 unclassified files. Their content is unknown.
- The review is based solely on the supplied source code and README; no binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.