epiphant

ExploitDB · Author

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

ExploitDB

Libmodplug 0.8.8.2 - '.abc' Stack Buffer Overflow (PoC)

ExploitDB exploitPublished 2011-04-28Not analyzedCVE-2011-17611 file

EDB-17222

ExploitDBPoC details
ExploitDB

html2ps - 'include file' Server-Side Include Directive Directory Traversal

ExploitDB exploitPublished 2009-09-25ExploitCVE-2009-50671 file

EDB-10012

ExploitDBPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The Python script generates an HTML file containing a Server-Side Include (SSI) directive with a directory traversal payload ('../../../../../../../etc/passwd') and then executes the 'html2ps' command on this file. This is intended to exploit a path traversal vulnerability in html2ps to read arbitrary files on the system.

Backdoor review

No backdoor observed in reviewed code

The provided Python script is a straightforward proof-of-concept (PoC) for CVE-2009-5067. It generates a static HTML file containing a directory traversal payload and then invokes the vulnerable 'html2ps' tool to process it. The script itself performs no backdoor behavior, such as establishing persistence, exfiltrating data, or downloading additional payloads. The only actions are writing a local file and executing two local commands, which are consistent with demonstrating the described vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwarehtml2ps
Attack typesDirectory Traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively generates a malicious HTML file and executes the vulnerable 'html2ps' command to exploit the directory traversal vulnerability, which constitutes an exploit.

exploits/multiple/webapps/10012.py:30exploits/multiple/webapps/10012.py:44

Requirements

  • html2ps must be installed and accessible in the system path.exploits/multiple/webapps/10012.py:44
  • The 'ssi' option must be enabled in the html2ps configuration (which is the default).exploits/multiple/webapps/10012.py:11-12

Observed behavior

  • Creates an HTML file named 'epiphant.html' containing an SSI include directive with a directory traversal payload.exploits/multiple/webapps/10012.py:23-34
  • Executes the 'html2ps' command on the crafted HTML file, which would trigger the SSI directive and attempt to read '/etc/passwd'.exploits/multiple/webapps/10012.py:44
  • Opens the resulting PostScript file with 'gv' to display the contents of the disclosed file.exploits/multiple/webapps/10012.py:45
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
Payload withheldThe script writes a static HTML file to the current working directory.exploits/multiple/webapps/10012.py:37
Command Execution
Payload withheldThe script executes the vulnerable 'html2ps' tool on the generated HTML file to trigger the directory traversal vulnerability.exploits/multiple/webapps/10012.py:44
Command Execution
Payload withheldThe script opens the generated PostScript file with 'gv' (GhostView) to display the output, which is a standard way to view the result of the PoC.exploits/multiple/webapps/10012.py:45
Review boundaries

What the analysis did not establish

  • The script is a local exploit that requires the attacker to have write access to the file system to create the HTML file and execute commands.
  • The script assumes the target system has 'html2ps' and 'gv' installed and configured with SSI enabled.
  • The review is limited to the supplied Python script. The behavior of the external 'html2ps' and 'gv' commands, which are not part of the artifact, is not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.