shinigami-777
Source-scoped identity with 4 associated PoCs and 4 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
GitHubshinigami-777/PoC_CVE-2025-11579
Repository PoCStars: 0Created 2025-10-19ExploitCVE-2025-115797 files
Analysis
Technical assessment
A Go program that uses the vulnerable rardecode library to open a crafted RAR file with an artificially large dictionary size, triggering an out-of-memory crash.
Backdoor review
No backdoor observed in reviewed code
The supplied text evidence (README.md, exploit.go, go.mod, go.sum) describes and implements a proof-of-concept for payload withheld, a denial-of-service vulnerability in the rardecode library. The Go code opens a provided RAR file and attempts extraction, which is expected to trigger an out-of-memory crash due to an excessively large dictionary size. No backdoor, deceptive payload, or concealed operator-directed harm is observed in the reviewed text files. Two binary RAR archives are present but were not analyzed; their metadata is reported but their contents are uninspected.
Classification basis and observed behavior
Classification basis
The artifact includes executable Go code (exploit.go) that actively opens a malicious RAR file to trigger the vulnerability, which is the definition of an exploit. The README explicitly states 'We craft a RAR file... causing the library to attempt massive memory allocations and then have an Out of Memory Crash' and instructs the user to run the code.
exploit.go:1-55README.md:6-10Requirements
- Requires the vulnerable rardecode library v2.1.1.
go.mod:5 - Requires a specially crafted RAR file (14Gb.rar) with an artificially large dictionary size.
README.md:7exploit.go:13
Observed behavior
- Opens the crafted RAR file and creates a reader, which triggers massive memory allocation and an out-of-memory crash.
exploit.go:15-26README.md:7 - Iterates through archive entries and attempts to extract files, though the crash likely occurs during reader initialization.
exploit.go:30-52
Behaviors behind the backdoor verdict
Observables
- Binary Archive
- Payload withheldBinary RAR file intended to trigger the DoS vulnerability; contents uninspected.
README.md:10 - Binary Archive
- Payload withheldBinary RAR file described as a normal file for successful extraction; contents uninspected.
README.md:13 - Vulnerability Reference
- Payload withheldThe PoC targets a known DoS vulnerability in rardecode <=2.1.1.
README.md:1
What the analysis did not establish
- The malicious RAR file (14Gb.rar) is present as a binary and was not analyzed; its exact structure is unknown.
- The evidence does not include runtime output confirming the crash, only a screenshot reference in the README.
- Two binary RAR files (14Gb.rar, simple.rar) are present in the artifact but were not analyzed; their contents could contain unrelated payloads.
- One text file (likely go.sum or similar) is reported in metadata but its content is not included in the evidence packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubshinigami-777/PoC_CVE-2025-2568
Repository PoCStars: 0Created 2025-10-05Not analyzedCVE-2025-25684 files
GitHubshinigami-777/PoC_CVE-2024-28157
Repository PoCStars: 0Created 2025-10-05WriteupCVE-2024-281572 files
Analysis
Technical assessment
The artifact is a README file that describes the CVE-2024-28157 vulnerability in the Jenkins GitBucket Plugin and provides manual exploitation steps. It does not contain any executable code, scanner logic, or automated detection mechanisms.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists solely of a README.md file describing a stored XSS vulnerability (CVE-2024-28157) in the Jenkins GitBucket Plugin. The text provides setup instructions using a standard Docker image, plugin installation via the Jenkins GUI, and manual exploitation steps involving a crafted XSS payload in the GitBucket URL field. No executable code, scripts, or commands are present in the reviewed text. The described behavior is consistent with the documented CVE and does not exhibit any concealed, deceptive, or operator-directed harm beyond the stated XSS proof-of-concept.
Classification basis and observed behavior
Classification basis
The artifact is a README file that provides a technical description of the vulnerability and manual exploitation steps, but contains no executable code, scanner logic, or automated detection mechanism. It is a writeup.
README.md:1-23Requirements
- A Jenkins instance with the vulnerable GitBucket Plugin (version 0.8 or earlier) installed.
README.md:4-6README.md:15 - An attacker must be able to configure jobs in Jenkins.
README.md:6
Observed behavior
- The README describes manual steps to trigger a stored XSS vulnerability by inserting a JavaScript payload into the Gitbucket URL field of a Jenkins job configuration.
README.md:18-20
Behaviors behind the backdoor verdict
Observables
- Xss Payload
- Payload withheldThe README instructs the user to manually enter this payload into the GitBucket URL field to demonstrate the stored XSS vulnerability. This is the expected behavior for a CVE-2024-28157 PoC.
README.md:19
What the analysis did not establish
- The artifact contains only a README file; a second file (likely the exploit video) is present in the repository but its content is not included in the evidence packet.
- The analysis is based solely on the supplied text; the described behavior has not been verified by execution.
- One text file (likely a license) and one binary file (a video) from the repository were not included in the evidence packet and were not reviewed.
- The review is limited to the provided text content; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubshinigami-777/PoC_CVE-2025-54887
Repository PoCStars: 0Created 2025-08-12ExploitCVE-2025-548874 files
Analysis
Technical assessment
A Ruby script that demonstrates exploitation of CVE-2025-54887 by brute-forcing a single-byte authentication tag on a JWE token encrypted with A256GCM, causing the vulnerable library to decrypt the ciphertext despite an invalid tag.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README and a single Ruby exploit script (exploit.rb) that demonstrates brute-forcing a single-byte authentication tag for CVE-2025-54887. The script uses standard JWE library calls to encrypt and decrypt, and iterates over 256 possible tag values to find one that decrypts successfully. No backdoor, concealed payload, persistence, credential theft, or unrelated remote access behavior is present. The code is straightforward and matches the stated PoC purpose.
Classification basis and observed behavior
Classification basis
The script actively modifies a JWE token's authentication tag and uses the vulnerable library to decrypt it, demonstrating a practical attack that bypasses integrity checks to recover plaintext. This is exploitation, not mere detection.
exploit.rb:13-31README.md:3Requirements
- Requires the vulnerable ruby-jwe gem version 1.1.0.
exploit.rb:1 - Requires a valid JWE token encrypted with the 'dir' algorithm and 'A256GCM' encryption.
exploit.rb:7 - Requires knowledge of the symmetric encryption key.
exploit.rb:5
Observed behavior
- Generates a random 32-byte key and encrypts a test string into a JWE token.
exploit.rb:5-7 - Splits the JWE token into its five components.
exploit.rb:10 - Iterates through all 256 possible single-byte values, replacing the original authentication tag with a crafted single-byte tag.
exploit.rb:13-21 - Attempts to decrypt the crafted JWE token; upon successful decryption, prints the working tag byte and the decrypted message, then stops.
exploit.rb:23-31
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe exploit.rb script demonstrates the vulnerability described in CVE-2025-54887 by crafting a JWE token with a single-byte tag and attempting decryption until one succeeds.
exploit.rb:12-31
What the analysis did not establish
- Only two of four repository files were provided as text; the other two files (likely the blog writeup and video) were omitted, so the full artifact context is incomplete.
- The evidence coverage is 'COMPLETE_FOR_READABLE_SELECTED_TEXT', not full artifact coverage, meaning some files were not analyzed.
- The script requires the encryption key, so it does not demonstrate a full keyless attack; it assumes the attacker already possesses the key.
- Two files (total 3236 bytes) were classified as unclassified/binary and were not analyzed; their content is unknown but they are not part of the selected text evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.