HackSpeak
Source-scoped identity with 8 associated PoCs and 8 linked vulnerabilities.
Exploit catalog results
Showing 8 PoCs on this page
GitHubHackSpeak/CVE-2026-17106
Repository PoCStars: 1Created 2026-08-11ExploitCVE-2026-1710612 files
Analysis
Technical assessment
The artifact is a complete exploit for CVE-2026-17106 (CopyEscape), a Docker `docker cp` arbitrary file write vulnerability. It contains C source code implementing a TOCTOU race condition attack using inotify and symlink pivoting, along with shell scripts to build and run the exploit in Docker containers targeting macOS and Linux hosts.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-17106 (CopyEscape). All reviewed source code and scripts implement the documented TOCTOU race condition to demonstrate arbitrary file write via 'docker cp'. The Linux variant targets /usr/bin/runc, and the macOS variant targets ~/pwnd, exactly as described in the README. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The artifact contains complete, compilable C code (monitor.c) that actively exploits a TOCTOU race condition to achieve arbitrary file write outside the container, along with shell scripts that build and execute the attack. This is code intended to exercise a vulnerability, not merely detect or report it.
linux/monitor.c:1-233macos/monitor.c:1-259macos/demo-macos.sh:1-88Requirements
- A vulnerable version of Docker (e.g., Engine/CLI 29.6.1, Desktop 4.81.0) must be installed on the host.
README.md:18-19 - The attacker must be able to build and run a malicious Docker container on the target host.
macos/demo-macos.sh:54-60 - The user must execute `docker cp` from the malicious container to the host.
macos/demo-macos.sh:74-75
Observed behavior
- The exploit sets up a directory layout inside the container with a regular file, a large trigger file, and a pre-staged symlink pointing to a host target directory.
linux/monitor.c:117-131macos/monitor.c:142-156 - A monitor process uses inotify to detect when `docker cp` accesses the trigger file, then performs a rename-based symlink pivot to replace a directory with the pre-staged symlink.
linux/monitor.c:148-225macos/monitor.c:173-250 - The TOCTOU race causes `docker cp` to follow the symlink and write files to an attacker-chosen location on the host (e.g., `/usr/bin/runc` on Linux or `~/pwnd` on macOS).
README.md:11-14linux/monitor.c:23-24macos/monitor.c:60-62 - The Linux variant overwrites `/usr/bin/runc` with a malicious script that creates a marker file, enabling subsequent root code execution.
linux/monitor.c:123 - The macOS variant creates a file `~/pwnd` in the user's home directory as a proof of successful exploitation.
macos/monitor.c:148macos/demo-macos.sh:80-83
Behaviors behind the backdoor verdict
Observables
- Exploit Target
- Payload withheldThe PoC overwrites these files to demonstrate the vulnerability, consistent with the README description.
linux/monitor.c:23-24macos/monitor.c:60-62 - Exploit Mechanism
- Payload withheldThe monitor programs use inotify to detect 'docker cp' access and perform a directory swap to redirect writes outside the container, matching the CVE description.
linux/monitor.c:133-146macos/monitor.c:158-171 - File Redirection
- Payload withheldThe preload library hides the symlink directory from the container's own view, a necessary part of the PoC setup.
linux/watched_preload.c:31-37macos/watched_preload.c:31-37
What the analysis did not establish
- The evidence packet reports 4 unclassified files (binary or other) that were not provided as text; their content is unknown.
- The evidence packet reports complete_artifact_coverage is false; 4 of 12 total files were omitted from the text selection.
- The CVE record for CVE-2026-17106 was absent from the acquired CVEList V5 dataset, so no authoritative CVE description is available for cross-reference.
- 4 text files were omitted from the evidence packet due to size constraints; their content was not reviewed.
- Binary files were not analyzed (binary_policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED), though none were identified in the inventory.
- The review is limited to the supplied static source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-64638
Repository PoCStars: 1Created 2026-08-08ExploitCVE-2026-646384 files
Analysis
Technical assessment
A Python-based exploit for CVE-2026-64638 that chains a pre-auth reflected XSS in WordPress login into full server-side RCE via DOM Clobbering, Application Password theft, page publishing, and malicious plugin upload.
Backdoor review
No backdoor observed in reviewed code
The PoC implements a documented XSS-to-RCE chain against WordPress (CVE-2026-64638). It serves attacker-controlled pages, captures an Application Password via social engineering, publishes a page containing upload JavaScript, and deploys a PHP shell plugin. All behavior aligns with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, functional Python script (xss2shell_poc.py) that actively exploits CVE-2026-64638 to achieve remote code execution. It generates XSS payloads, hosts an attacker server, captures credentials, publishes a page, uploads a malicious plugin, and executes arbitrary commands on the target. This is clearly exploit code, not a scanner or writeup.
xss2shell_poc.py:1-558README.md:9-13Requirements
- A WordPress instance vulnerable to CVE-2026-64638 (versions < 7.0.3).
README.md:14 - An administrator of the target WordPress site must be socially engineered to visit an attacker-controlled URL and log in.
README.md:29xss2shell_poc.py:473-476 - The attacker must run a Python server to host the exploit pages and receive callbacks.
xss2shell_poc.py:370-373xss2shell_poc.py:465-467
Observed behavior
- Starts an HTTP server to host the exploit pages and receive beacon callbacks from the victim's browser.
xss2shell_poc.py:370-373xss2shell_poc.py:465-467 - Generates an XSS payload that exploits a parsing difference between PHP strip_tags() and WordPress KSES to inject HTML/JavaScript into the login error page.
README.md:11xss2shell_poc.py:128-133 - Uses DOM Clobbering to hijack the 'ajaxurl' variable, triggering a jQuery POST that leads to Same Origin Method Execution (SOME) and automatic click of the Application Password approval button.
README.md:13xss2shell_poc.py:128-130 - Captures the generated Application Password via a callback URL and saves it to a local JSON file.
xss2shell_poc.py:316-326xss2shell_poc.py:64-76 - Uses the stolen credentials to publish a new WordPress page containing JavaScript that uploads a malicious plugin ZIP.
xss2shell_poc.py:216-234xss2shell_poc.py:258-262 - The uploaded plugin contains a PHP web shell (shell.php) that executes arbitrary commands passed via the 'cmd' parameter.
xss2shell_poc.py:274-282 - Executes a user-supplied command on the target server via the web shell and prints the output.
xss2shell_poc.py:526-531 - Optionally cleans up the published page after exploitation.
xss2shell_poc.py:542-554
Behaviors behind the backdoor verdict
Observables
- Credential Capture
- Payload withheldThe PoC captures the victim's Application Password as part of the documented RCE chain, not as a hidden backdoor.
xss2shell_poc.py:316-326 - Php Shell Deployment
- Payload withheldThe shell.php file executes arbitrary commands via shell_exec(), which is the intended RCE payload of the PoC.
xss2shell_poc.py:272-282 - Attacker Server
- Payload withheldThe server is part of the PoC infrastructure to deliver the XSS payload and coordinate the attack steps.
xss2shell_poc.py:290-356
What the analysis did not establish
- The evidence includes only two of four repository files; the other two files (likely .gitignore and LICENSE) are omitted but are not expected to alter the classification.
- The analysis is based solely on static code review; the code was not executed, and its operational reliability is not verified.
- Two files (total 4) were omitted from text content due to size/selection policy; their metadata shows no binary content, but their text was not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-64564
Repository PoCStars: 4Created 2026-08-07ExploitCVE-2026-645643 files
Analysis
Technical assessment
The artifact is a local privilege escalation (LPE) exploit for CVE-2026-64564 in the Linux kernel SCTP subsystem. It triggers a use-after-free (UAF) vulnerability via crafted ASCONF DEL-IP chunks, then uses heap spraying and a fake kernel object graph to achieve code execution, escalating to root privileges. The code includes a complete exploitation chain: UAF trigger, KASLR bypass, kernel read primitive, and credential overwrite.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a C source file implementing a Linux kernel SCTP ASCONF DEL-IP Use-After-Free local privilege escalation proof-of-concept for CVE-2026-64564. The code performs the described exploit steps: namespace setup, multihomed SCTP association creation, ASCONF DEL-IP injection to trigger UAF, heap spraying for reclaim, KASLR bypass, and credential overwrite to gain root. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the person running the PoC was observed. The artifact's behavior is consistent with the stated vulnerability exploitation and does not exhibit operator-directed harm beyond the intended privilege escalation.
Classification basis and observed behavior
Classification basis
The code actively triggers the vulnerability and uses it to escalate privileges to root, which is the definition of an exploit. It does not merely detect or report the vulnerability; it exercises it to achieve code execution and privilege escalation.
lpe_debian.6.12.95.c:1-842README.md:1-44Requirements
- Requires an unprivileged local user account to execute the exploit.
lpe_debian.6.12.95.c:1-842 - Target system must have the SCTP kernel module loaded and configurable via sysctl (addip_enable, addip_noauth_enable).
README.md:19 - Exploit is compiled and targeted for Debian 13 with kernel 6.12.95; other kernels require manual offset adaptation.
README.md:18
Observed behavior
- Creates isolated user and network namespaces to configure SCTP loopback without requiring root.
lpe_debian.6.12.95.c:206-227 - Establishes a multihomed SCTP association and sends a raw ASCONF chunk containing a DEL-IP for a non-source address followed by a wildcard DEL-IP to trigger a use-after-free of the transport structure.
lpe_debian.6.12.95.c:237-250lpe_debian.6.12.95.c:318-366 - Reclaims the freed transport memory with a PACKET_TX_RING spray to leak a direct-map page address, then uses a crafted fake transport to build an arbitrary 32-bit kernel read primitive.
lpe_debian.6.12.95.c:598-617lpe_debian.6.12.95.c:479-504 - Leaks the KASLR slide by reading the IDT handler address, then walks kernel data structures to locate the victim SCTP association.
lpe_debian.6.12.95.c:575-584lpe_debian.6.12.95.c:541-571 - Triggers a second UAF on the association's active_path, reclaims it with a forged SCTP transport/association/credential graph via SCTP auth key spray, and closes the socket to trigger commit_creds() with controlled credentials, achieving root.
lpe_debian.6.12.95.c:685-714lpe_debian.6.12.95.c:812-823 - Verifies root by reading /etc/shadow and writing a marker file to /root/SCTP_LPE_SUCCESS.
lpe_debian.6.12.95.c:824-832
Behaviors behind the backdoor verdict
Observables
- Privilege Escalation Mechanism
- Payload withheldThe PoC exploits CVE-2026-64564 to escalate privileges from an unprivileged user to root, as described in the README and implemented in the C code.
README.md:9lpe_debian.6.12.95.c:593-841 - Kernel Memory Corruption
- Payload withheldThe code sends raw IP packets containing ASCONF DEL-IP parameters to free a transport and then reclaims the freed memory with controlled data to hijack control flow.
lpe_debian.6.12.95.c:236-250lpe_debian.6.12.95.c:357-365 - Root Verification
- Payload withheldThe PoC verifies successful privilege escalation by reading a protected file and creating a marker file in /root, which is standard for LPE PoCs.
lpe_debian.6.12.95.c:587-592lpe_debian.6.12.95.c:830-832
What the analysis did not establish
- The evidence includes only the README and the C source file; a third file (likely a Makefile or similar) is present in the repository but not included in the packet.
- The exploit is explicitly stated to be untested on real hardware ('未经真机验证') and may cause kernel crashes.
- The exploit is targeted at a specific Debian 13 kernel version (6.12.95) and requires manual offset adaptation for other kernels.
- One unclassified file (1066 bytes) was present in the repository but not included in the text evidence; its content and potential behavior are unknown.
- The review is limited to static analysis of the provided source code and README; no dynamic execution or binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-17566
Repository PoCStars: 1Created 2026-08-04ExploitCVE-2026-175663 files
Analysis
Technical assessment
Python script that authenticates to pgAdmin 4, enumerates servers, and sends a crafted POST request to /import_export/job/<sid> with a malicious SQL query designed to exploit CVE-2026-17566. The payload injects a TO PROGRAM clause into a psql \copy command, aiming for remote code execution on the pgAdmin host.
Backdoor review
No backdoor observed in reviewed code
The PoC implements the documented CVE-2026-17566 exploit path: login, enumerate servers, and POST a crafted query to /import_export/job/<sid> to trigger RCE via psql TO PROGRAM injection. No concealed backdoor, unrelated payload, or deceptive behavior was observed. The code is a straightforward exploit script with no hidden functionality.
Classification basis and observed behavior
Classification basis
The Python script actively performs the steps required to exploit CVE-2026-17566: it authenticates, performs reconnaissance, constructs a payload that injects an OS command into a psql \copy command, and sends it to the vulnerable endpoint. This is code intended to exercise a vulnerability, not merely detect it.
pgadmin4_rce_poc.py:1-221README.md:1-3Requirements
- Authenticated low-privilege pgAdmin user with tools_import_export_data permission
README.md:26 - Network access to a pgAdmin 4 instance < 9.18
README.md:27-28
Observed behavior
- Logs into pgAdmin by fetching /login for a CSRF token and posting credentials
pgadmin4_rce_poc.py:67-95 - Enumerates available database servers via GET /browser/servers
pgadmin4_rce_poc.py:98-112 - Constructs a malicious SQL query containing a TO PROGRAM clause to execute an arbitrary OS command
pgadmin4_rce_poc.py:115-128 - Sends the crafted payload via POST /import_export/job/<sid> to trigger the vulnerability
pgadmin4_rce_poc.py:131-155
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe build_query method constructs a payload that exploits the parenthesis-balance checker's misinterpretation of backslash-escaped quotes, enabling command execution via psql's popen().
pgadmin4_rce_poc.py:116-128 - Command Execution
- Payload withheldThe script accepts --command or --reverse arguments and passes them to the trigger method, which sends the exploit payload to the vulnerable endpoint.
pgadmin4_rce_poc.py:165-187pgadmin4_rce_poc.py:131-155 - Authentication Flow
- Payload withheldThe login method performs a GET /login to extract the _form_token, then POSTs credentials. This is normal exploit behavior for authenticated RCE.
pgadmin4_rce_poc.py:67-95
What the analysis did not establish
- The author states the script is 'NOT TESTED against a live instance' and 'request body field names may need minor adjustment' (pgadmin4_rce_poc.py lines 14-16).
- One file (total 3) is omitted from the evidence packet; its content is not available for analysis.
- One file (LICENSE) was present in the repository but not included as text content; it is a standard MIT license file and unlikely to contain executable behavior.
- The PoC author states the script was not tested against a live instance; the review assesses only the supplied code, not its runtime behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-60004
Repository PoCStars: 1Created 2026-08-04ExploitCVE-2026-600043 files
Analysis
Technical assessment
A Python script that exploits CVE-2026-60004 in Gitea to achieve remote code execution. It authenticates to a Gitea instance, creates a repository, and sends a crafted diffpatch payload twice to trigger a Git hook execution, then retrieves the command output.
Backdoor review
No backdoor observed in reviewed code
The PoC implements the documented CVE-2026-60004 exploit against Gitea diffpatch. It authenticates, creates a repo, sends a crafted patch twice to trigger a Git hook, and retrieves command output via the same Gitea instance. No concealed backdoor, unrelated payload, or operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional Python script that actively exploits a vulnerability to execute arbitrary shell commands on a remote Gitea server. It performs all steps of the attack chain: authentication, repository creation, payload delivery, and output retrieval. This is consistent with the definition of an exploit.
gitea_diffpatch_rce_poc.py:1-332README.md:3Requirements
- Write access to a repository on the target Gitea instance, or the instance must have open registration enabled.
README.md:22-23 - Target server must have Git version 2.32 or higher to enable the -3 three-way merge fallback.
README.md:23 - The diffpatch API endpoint must be available.
README.md:24
Observed behavior
- Authenticates to the Gitea instance using provided credentials.
gitea_diffpatch_rce_poc.py:253-260 - Creates a new private repository on the target instance.
gitea_diffpatch_rce_poc.py:266-274 - Constructs a malicious patch containing a post-index-change Git hook that executes the attacker-supplied shell command and stores the output in a Git object.
gitea_diffpatch_rce_poc.py:120-144 - Sends the malicious patch to the diffpatch endpoint twice to trigger an add/add conflict and force the checkout of the hook file.
gitea_diffpatch_rce_poc.py:287-299 - Fetches the command output from the repository using Git's smart HTTP protocol.
gitea_diffpatch_rce_poc.py:175-195
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldMatches the described CVE-2026-60004 attack chain; the hook executes the user-supplied command and stores output in the origin repository for retrieval.
gitea_diffpatch_rce_poc.py:120-144gitea_diffpatch_rce_poc.py:276-299 - Output Retrieval
- Payload withheldThe PoC retrieves the result of the executed command through the same Gitea instance, consistent with the README claim of in-band output retrieval.
gitea_diffpatch_rce_poc.py:175-195gitea_diffpatch_rce_poc.py:301-303
What the analysis did not establish
- One file (unclassified, 1066 bytes) was omitted from the evidence and not analyzed.
- The CVE record for CVE-2026-60004 was absent from the acquired CVEList V5 dataset.
- One file (LICENSE) was omitted from the text evidence; its content is not reviewed.
- Binary files were not present in the evidence.
- The review is limited to the supplied text; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-16232
Repository PoCStars: 2Created 2026-08-03ExploitCVE-2026-162323 files
Analysis
Technical assessment
A Python 3 script that exploits CVE-2026-16232, an authentication bypass in Check Point SmartConsole. It connects to the unauthenticated SIC/CPMI service, reuses the server's own SIC DN to forge an application certificate bind, obtains an application DLE token, mints a SmartConsole SSO ticket via gen-sso-token, and redeems it to gain a full administrative session, demonstrated by enumerating administrators via GetAllAdmins.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python PoC script and a README for CVE-2026-16232, an authentication bypass in Check Point SmartConsole. The script demonstrates the exploit by connecting to the target, forging an application bind, obtaining a token, and escalating to an administrator session. All behavior is consistent with the stated vulnerability and contains no concealed executable payload, credential exfiltration, persistence mechanism, or unrelated remote access. No backdoor or deceptive payload targeting the person running the PoC was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete, executable Python script that actively exploits CVE-2026-16232 to bypass authentication and gain full administrative privileges on a Check Point management server. It performs the full attack chain: unauthenticated SIC/CPMI handshake, forged certificate bind, token acquisition, SSO ticket minting, and session redemption to enumerate administrators. The README explicitly describes it as a PoC for an authentication bypass and states it is for security research and vulnerability verification.
CVE-2026-16232.py:1-13CVE-2026-16232.py:373-481README.md:1-3Requirements
- Network access to the management server's SIC/CPMI port (default 18190) and CPM SOAP port (default 19009).
CVE-2026-16232.py:26-28CVE-2026-16232.py:232CVE-2026-16232.py:304 - The target management server must not restrict Trusted Clients.
CVE-2026-16232.py:1 - The target must be running a vulnerable version of Check Point management software (e.g., R81.20 with Jumbo Hotfix Take 158 or below).
README.md:13
Observed behavior
- Connects to the target's FWM port, performs an unauthenticated SIC/CPMI handshake, and retrieves the management server's SIC DN.
CVE-2026-16232.py:229-238 - Sends a client_set command presenting as an application client (SmartView Reporter Client) without administrator privileges.
CVE-2026-16232.py:393 - Sends a certificate_bind command with the server's own SIC DN in the :DN field, exploiting the vulnerability to forge an application identity.
CVE-2026-16232.py:397-407 - Sends an open-database command to obtain a DLE application token.
CVE-2026-16232.py:415-431 - Uses the application token to call the protected getServerInfo SOAP API and prints server details.
CVE-2026-16232.py:435-439 - Sends a gen-sso-token command to mint a SmartConsole SSO ticket with full permissions (ffffffff|ffffffff|ffffffff).
CVE-2026-16232.py:446-465 - Redeems the SSO ticket via a loginNew SOAP request to obtain a full administrative DLE session.
CVE-2026-16232.py:349-370 - Calls GetAllAdmins with the administrative session and prints the list of administrators, demonstrating elevated privileges.
CVE-2026-16232.py:472-477
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe PoC connects to the user-supplied target to demonstrate the exploit; this is expected behavior for a vulnerability PoC.
CVE-2026-16232.py:232CVE-2026-16232.py:304 - Authentication Bypass
- Payload withheldThis is the core vulnerability being demonstrated; the script explicitly documents this as the root cause.
CVE-2026-16232.py:395-401 - Privilege Escalation
- Payload withheldThe PoC escalates from an application token to a full administrator session, which is the intended demonstration of impact.
CVE-2026-16232.py:446-464
What the analysis did not establish
- One file (sha256:sha256:3497d4f1000da12d180c289a4e2164a096f3f9c30ce740291bf098623be28f91) was omitted from the evidence; its content is not available for analysis.
- The evidence does not include the full repository snapshot; only two of three files are provided.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its behavior is inferred from the source.
- One file (unclassified, 1066 bytes) was omitted from the evidence and not analyzed; its content is unknown.
- Binary analysis was not performed; the artifact contains no identified binary files.
- The review is limited to static analysis of the supplied text; no dynamic execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-66066
Repository PoCStars: 2Created 2026-08-03ExploitCVE-2026-660663 files
Analysis
Technical assessment
A Python 3.11+ tool that exploits CVE-2026-66066 in Rails Active Storage with libvips. It crafts a hybrid MATLAB/HDF5 file to achieve arbitrary file read via the HDF5 External File List mechanism, recovers SECRET_KEY_BASE from /proc/self/environ, and forges a signed variation to execute arbitrary commands on the target server. Includes scan, probe, and check modes.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python script (kr2s.py) that implement a PoC for CVE-2026-66066. The code exercises the documented arbitrary-file-read chain and conditional RCE escalation exactly as described in the CVE and README. No concealed backdoor, unrelated payload, credential exfiltration to an attacker-controlled destination, or persistence mechanism was observed. The script's behavior is limited to interacting with a user-supplied target to demonstrate the vulnerability.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exploits the vulnerability to achieve arbitrary file read and remote code execution. The 'rce' command recovers SECRET_KEY_BASE and executes attacker-supplied commands on the target. The 'check' and 'scan --active' commands upload malicious blobs to confirm the vulnerability. This goes beyond detection or scanning and constitutes an exploit.
kr2s.py:752-821kr2s.py:612-640kr2s.py:1006-1061Requirements
- Target Rails application uses Active Storage with libvips variant processing and accepts image uploads from untrusted users.
README.md:9 - Target is running a vulnerable Rails version (< 7.2.3.2, >= 8.0 < 8.0.5.1, >= 8.1 < 8.1.3.1) and libvips >= 8.13.
README.md:14-15
Observed behavior
- Crafts a hybrid file with MATLAB 5.0 header and HDF5 structure containing an external file list pointing to an arbitrary server-side path.
kr2s.py:104-151 - Uploads the crafted file to the Rails direct upload endpoint, claiming a content_type of image/png.
kr2s.py:435-486 - Triggers variant processing, causing libvips to read the external file and embed its content into a generated PNG image.
kr2s.py:492-537 - Decodes the returned PNG to recover the arbitrary file content.
kr2s.py:173-272 - Reads /proc/self/environ to extract SECRET_KEY_BASE and other secrets.
kr2s.py:666-738 - Uses the recovered SECRET_KEY_BASE to forge a signed Active Storage variation containing Ruby code that executes an arbitrary shell command.
kr2s.py:167-170kr2s.py:752-821 - Includes a scan mode that can actively upload malicious blobs to confirm vulnerability on multiple targets.
kr2s.py:1006-1061
Behaviors behind the backdoor verdict
Observables
- File Read Primitive
- Payload withheldThis is the core of the documented CVE-2026-66066 exploit chain.
kr2s.py:540-562 - Rce Escalation
- Payload withheldThis matches the conditional RCE escalation described in the CVE and README.
kr2s.py:752-821 - Target Interaction
- Payload withheldAll network activity is directed at the target specified by the user; no external exfiltration is performed.
kr2s.py:435-486kr2s.py:492-537
What the analysis did not establish
- One file (likely lab/Dockerfile or similar) was omitted from the packet due to text budget, but the two included files (README.md and kr2s.py) provide complete coverage of the tool's behavior and classification.
- One file (lab/ directory content) was omitted from the text evidence and was not reviewed. The inventory reports it as 1062 bytes of unclassified content, but its absence does not affect the analysis of the main PoC script.
- The review does not assess the safety or correctness of the exploit code; it only evaluates the presence of backdoor or deceptive behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-64531
Repository PoCStars: 6Created 2026-08-03ExploitCVE-2026-645313 files
Analysis
Technical assessment
A Python script (ovswrap-poc.py) that exploits CVE-2026-64531 in the Linux kernel's Open vSwitch module to achieve local privilege escalation from an unprivileged user to root. It constructs oversized nested action attributes to trigger a 16-bit nla_len integer wrap, gaining arbitrary kernel read and decrement primitives. It then locates a host process's credentials, modifies them to gain full capabilities, and writes a sudoers entry to obtain a root shell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python PoC script for CVE-2026-64531, a Linux kernel Open vSwitch local privilege escalation. The script uses netlink sockets to trigger a kernel vulnerability, gain arbitrary read/write primitives, modify kernel credentials, and write a sudoers entry to obtain a root shell. All observed behavior is consistent with the stated exploit goal; no concealed backdoor, unrelated payload, or deceptive operator-directed harm was found.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, self-contained Python script (ovswrap-poc.py) that actively exploits CVE-2026-64531 to achieve local privilege escalation. It constructs malicious OVS flow actions, corrupts kernel memory, and modifies process credentials to gain root access, which is the definition of an exploit.
README.md:3ovswrap-poc.py:1-2154Requirements
- Unprivileged user with ability to create user and network namespaces (unshare -Urn).
README.md:14README.md:33 - Affected Linux kernel with OVS conntrack support and FTP conntrack helper loaded.
README.md:32 - Python 3.7+ and sudo installed.
README.md:34
Observed behavior
- Enters a private user and network namespace via unshare -Urn.
ovswrap-poc.py:658-682 - Creates an OVS datapath and installs a flow with an oversized CLONE action containing many CT actions to trigger the nla_len wrap.
ovswrap-poc.py:1104-1115ovswrap-poc.py:1146-1154 - Leaks a kernel pointer (nf_conntrack_helper) from the corrupted flow dump.
ovswrap-poc.py:1328-1342 - Establishes arbitrary kernel read and decrement primitives by crafting fake SET actions that manipulate tunnel metadata.
ovswrap-poc.py:1345-1488ovswrap-poc.py:1497-1536 - Locates the host sudoers writer process's task_struct and cred via the init_pid_ns idr.
ovswrap-poc.py:1684-1713 - Modifies the host process's credentials (fsuid/fsgid or capability words) to gain root privileges.
ovswrap-poc.py:1768-1804 - Writes a sudoers drop-in file to grant the original user passwordless sudo, then spawns a root shell.
ovswrap-poc.py:1840-1862ovswrap-poc.py:608-632
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal, documented behavior of the PoC and does not constitute a backdoor.
README.md:3ovswrap-poc.py:2025-2137 - Embedded Data
- Payload withheldThis is a legitimate technique for a PoC to support multiple kernel versions without requiring dynamic derivation. The data is used solely for the exploit's offset calculations.
ovswrap-poc.py:190-192ovswrap-poc.py:328-341 - Sudoers Modification
- Payload withheldThis is the intended privilege escalation outcome described in the README and is not a hidden backdoor.
README.md:44ovswrap-poc.py:1840-1939
What the analysis did not establish
- One file (LICENSE) was omitted from the packet due to size limits, but it is not material to the classification.
- The embedded kernel record table is base85-encoded and compressed; its contents were not decoded or analyzed.
- One file (unclassified, 18092 bytes) was omitted from the text evidence and was not analyzed; its content is unknown.
- Binary content within the artifact was not inspected (metadata-only analysis).
- The review is based solely on the supplied text evidence; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.