moscovium-mc

GitHub · Repository owner · Source ID 155406798
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

moscovium-mc/Tor-0day-JavaScript-Exploit

Repository PoC10Created 2025-11-07ExploitCVE-2024-96806 files

53.2 KiB

GitHubPoC details
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The repository contains a complete, functional exploit for CVE-2024-9680, a use-after-free vulnerability in Firefox's Animation timelines. The primary artifact is a JavaScript-based exploit that uses heap spraying, SVG animation manipulation, and a Web Worker to achieve remote code execution in the browser's content process. The code includes shellcode, ROP chain construction, and memory corruption techniques.

Backdoor review

Suspicious behavior

The repository presents itself as an educational analysis of CVE-2024-9680 with safety modifications. However, the 'educational' index.html file contains the full, unmodified exploit logic, including shellcode delivery and memory corruption, which directly contradicts its own claim that 'dangerous functionality has been neutralized' and 'redirects have been disabled'. The original.html file further shows a redirect to 'payload withheld', a behavior the index.html claims to have removed but which is still present in the repository. This material contradiction between the artifact's documentation and its actual content is a positive concern.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesJavaScriptHTML
Target softwareFirefoxTor BrowserThunderbird
Attack typesUse-After-FreeRemote Code ExecutionHeap Spraying
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as an exploit because it contains complete, functional code designed to trigger a vulnerability (CVE-2024-9680) and achieve remote code execution. The code includes shellcode, heap spraying, ROP chain construction, and a use-after-free trigger. The README and HTML files explicitly state it is an 'exploit' and a 'PoC', and the code performs all steps necessary for exploitation, not just detection.

README.md:3README.md:23exploit/index.html:4exploit/index.html:90exploit/cssbanner.js:1-291

Requirements

  • Victim must use a vulnerable version of Firefox (e.g., < 131.0.2) or Tor Browser.README.md:27-29
  • The exploit targets Windows x86 systems, as indicated by the shellcode and ROP chain construction.exploit/cssbanner.js:56-106exploit/index.html:269

Observed behavior

  • The exploit delivers encoded shellcode to a Web Worker for execution.exploit/index.html:97-106
  • It performs heap spraying by creating many ArrayBuffer objects to control memory layout.exploit/index.html:112-115exploit/index.html:140-159
  • It crafts a complex SVG DOM structure with circular animation timing references to set up the use-after-free condition.exploit/index.html:194-229
  • The use-after-free is triggered by calling pauseAnimations() after manipulating animation attributes, leading to memory corruption and code execution.exploit/index.html:149-169
  • The Web Worker (cssbanner.js) constructs a ROP chain and resolves Windows API functions (e.g., VirtualAlloc, CreateThread) to execute the shellcode.exploit/cssbanner.js:107-156exploit/cssbanner.js:267-284
  • After exploitation, the original exploit redirects the browser to 'payload withheld' for a secondary payload.exploit/original.html:159
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Material Contradiction
  • The index.html file claims 'dangerous functionality has been neutralized' and 'Redirects have been disabled', but it contains the full, unmodified exploit code including shellcode delivery, heap spraying, and UAF trigger, and the repository also contains original.html which performs a redirect to 'payload withheld'.exploit/index.html:255exploit/index.html:97-101exploit/original.html:159

Observables

Shellcode
Payload withheldThe shellcode is delivered to a Web Worker and is part of the exploit chain for remote code execution.exploit/index.html:97-101
Url
Payload withheldThe original.html file redirects the browser to 'payload withheld' after 2 seconds, which is a post-exploitation behavior.exploit/original.html:159
Review boundaries

What the analysis did not establish

  • The evidence includes a non-text media file (tr.png) and an unclassified file that were not analyzed, but their content is not required for classification.
  • The 'exploit/index.html' file is described as a 'safety-hardened' version with disabled redirects, but the core exploitation logic (heap spray, UAF trigger, worker communication) remains intact and functional.
  • The analysis is based solely on static code review; the code was not executed, and its reliability or effectiveness on a live system is not verified.
  • The analysis is limited to the supplied text files. The binary file (tr.png) and the omitted text file (LICENSE) were not reviewed.
  • The actual behavior of the shellcode and the 'payload withheld' redirect target cannot be determined from the provided evidence alone.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.