portbuster1337
Source-scoped identity with 6 associated PoCs and 6 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
GitHubportbuster1337/CVE-2026-46376
Repository PoCStars: 0Created 2026-05-29ExploitCVE-2026-463762 files
Analysis
Technical assessment
Python script (poc.py) that actively exploits CVE-2026-46376 by sending HTTP requests to a target FreePBX instance. It attempts to log into the UCP using hard-coded credentials, bypass an unlock key, and test default admin credentials. The README documents the vulnerability and usage.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a README and a Python script that demonstrate the CVE-2026-46376 vulnerability by attempting UCP login with hard-coded credentials, an unlock key bypass, and default admin credential testing. All actions are directed at the stated target and are consistent with legitimate security testing. No concealed payloads, persistence mechanisms, credential exfiltration to third parties, or unrelated remote access were observed.
Classification basis and observed behavior
Classification basis
The artifact contains executable Python code (poc.py) that actively sends crafted HTTP requests to a target to gain unauthorized access using hard-coded credentials, an unlock key bypass, and default admin credentials. The README explicitly labels it as a PoC and describes exploitation steps. This is an exploit, not a scanner, because it attempts to perform the actual unauthorized login and access, not merely detect the vulnerability.
poc.py:1-319README.md:36-41README.md:60-62Requirements
- Target must be running an affected FreePBX version (15.0.42+, userman <= 16.0.44, or userman <= 17.0.6) and the UCP generic template setup must have been performed by an administrator.
README.md:11README.md:24poc.py:32-36 - The target's UCP interface must be accessible over the network.
poc.py:111-115
Observed behavior
- Sends a GET request to the target root to check reachability.
poc.py:90 - Fetches /admin/config.php to extract the FreePBX version string and determine if it falls within the affected range.
poc.py:98-99 - Checks if the UCP interface is present by requesting /ucp/index.php and searching for 'User Control Panel' in the response.
poc.py:112-113 - Attempts to log into the UCP by POSTing the hard-coded credentials (payload withheld) to /ucp/ajax.php with module=User&command=login.
poc.py:141-154 - Attempts an unlock key bypass by iterating templateid values (0-5) in a GET request to /ucp/index.php?unlockkey=test&templateid=<tid> and checking for authenticated page indicators.
poc.py:177-193 - Attempts to log into the admin panel (/admin/config.php) using a list of common default credentials (payload withheld).
poc.py:212-232 - Reports the target as VULNERABLE if any exploit method succeeds.
poc.py:304-305
Behaviors behind the backdoor verdict
Observables
- Hard Coded Credentials
- Payload withheldCredentials used in the PoC to demonstrate the vulnerability; they are the subject of the CVE and are not hidden or used for unrelated access.
poc.py:24-25 - Default Admin Credential List
- Payload withheldCommon default credentials tested against the admin panel as part of the PoC's method 3; standard for security testing tools.
poc.py:26-31 - Network Request
- Payload withheldThe primary exploit request that attempts login with the hard-coded credentials; directed only at the user-supplied target.
poc.py:140-154 - Network Request
- Payload withheldAttempts an unlock key bypass; directed only at the user-supplied target.
poc.py:177-183 - Network Request
- Payload withheldAttempts admin panel login with common defaults; directed only at the user-supplied target.
poc.py:212-222
What the analysis did not establish
- The evidence includes only two text files (README.md and poc.py). No binary files, network captures, or execution logs are provided. The analysis is based solely on static review of the source code and documentation; the code was not executed, and its actual effectiveness is not verified.
- Only the two text files (README.md and poc.py) were reviewed; no binary or other files were present in the artifact.
- The review does not assess whether the PoC actually works or is safe to run; it only evaluates the presence of backdoor or deceptive behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubportbuster1337/CVE-2026-52806
Repository PoCStars: 6Created 2026-05-28ExploitCVE-2026-528062 files
Analysis
Technical assessment
Python exploit for CVE-2026-52806, an authenticated RCE in Gogs via argument injection in git rebase. The script automates pre-flight checks, account registration, API token creation, repository setup, malicious branch push, pull request creation, and merge triggering to execute arbitrary commands on the target server.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script for CVE-2026-52806, a command injection vulnerability in Gogs. The script automates exploitation of the described vulnerability by creating a malicious branch name that injects the --exec flag into a git rebase command. All behavior is consistent with a standard proof-of-concept exploit for the stated CVE. No concealed executable behavior, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the declared exploit was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete Python script (gogs.py) that automates the full exploitation chain: pre-flight detection, authentication, repository manipulation, malicious branch push, pull request creation, and merge triggering to achieve remote code execution. The README explicitly describes it as an exploit and provides usage examples for running commands and reverse shells.
README.md:1-4gogs.py:1-10gogs.py:658-721Requirements
- Python 3.6+ with requests library
README.md:43-44 - Local git installation
README.md:45 - Valid Gogs credentials or ability to auto-register an account
README.md:20-24 - Target Gogs instance with 'Rebase before merging' enabled or configurable
gogs.py:413-431
Observed behavior
- Performs pre-flight checks to detect Gogs, version, and registration status
gogs.py:146-212 - Automatically registers a new user account if registration is open and no captcha is required
gogs.py:310-331 - Creates an API token via Basic auth or web settings page
gogs.py:333-356 - Creates a temporary private repository and enables rebase merging
gogs.py:390-431 - Pushes a malicious branch named '--exec=sh${IFS}.payload' containing attacker command
gogs.py:438-489 - Creates a pull request from a feature branch into the malicious branch
gogs.py:491-525 - Triggers merge with merge_style=rebase_before_merging, causing command execution via git rebase --exec
gogs.py:527-553 - Cleans up temporary repository and local files
gogs.py:555-581
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit mechanism for the stated CVE and is not a backdoor.
gogs.py:450 - External Reference
- Payload withheldThis is a recommendation for a separate, external tool and is not part of the supplied artifact's executable behavior. The artifact itself does not download or execute this binary.
README.md:99-114
What the analysis did not establish
- Evidence does not include execution output or verification that the exploit succeeds.
- The artifact is a single snapshot; no version history or commit context is provided.
- Binary or opaque content is not present; all supplied files are readable text.
- Only the two text files (README.md and gogs.py) were provided and reviewed. No binary files were present in the evidence.
- The review does not assess the safety or legitimacy of the externally referenced 'lpe-toolkit' binary, as it is not part of the supplied artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubportbuster1337/CVE-2026-27771
Repository PoCStars: 18Created 2026-05-27ExploitCVE-2026-277712 files
Analysis
Technical assessment
A Python script that exploits CVE-2026-27771, an authorization bypass in Gitea's container registry, to pull private container images without authentication. It includes scan, pull, and auto-registration commands.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script and a README for CVE-2026-27771, a Gitea container registry authorization bypass. The code performs OCI registry enumeration, manifest and blob download, and optional account registration—all actions consistent with demonstrating the described vulnerability. No concealed executable behavior, unrelated payload delivery, credential exfiltration to an external party, persistence mechanism, or operator-directed harm was observed. The script's network requests target only the user-supplied Gitea instance, and all downloaded content is written to local disk under predictable output directories.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively exploits the vulnerability by obtaining an anonymous token, enumerating private repositories, and downloading their container image layers. The README explicitly labels it as an 'Exploit PoC' and describes its purpose as pulling private container images without authentication.
CVE-2026-27771-exploit.py:3-8README.md:55README.md:92-97Requirements
- Target Gitea instance < 1.26.2 with OCI container registry enabled
README.md:60 - Python 3.8+
README.md:59
Observed behavior
- Performs a pre-flight check to determine Gitea version, registry presence, and vulnerability status
CVE-2026-27771-exploit.py:313-409 - Obtains an anonymous ghost token (UserID: -1) from /v2/token when REQUIRE_SIGNIN_VIEW is false
CVE-2026-27771-exploit.py:384-396 - Enumerates all container repositories via /v2/_catalog, including private ones
CVE-2026-27771-exploit.py:414-418 - Lists tags for each repository via /v2/<repo>/tags/list
CVE-2026-27771-exploit.py:421-425 - Fetches OCI manifests and downloads all blob layers for each tag
CVE-2026-27771-exploit.py:428-451 - Extracts downloaded gzip-compressed tar layers to a local directory
CVE-2026-27771-exploit.py:517-528 - Supports auto-registration of new accounts on instances without captcha
CVE-2026-27771-exploit.py:151-285
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldDemonstrates that the script only interacts with the target Gitea instance and does not contact any unrelated external service.
CVE-2026-27771-exploit.py:68-76CVE-2026-27771-exploit.py:129-131CVE-2026-27771-exploit.py:414-451 - File System Behavior
- Payload withheldAll output is written to predictable local paths derived from the repository name; no system file modification or hidden directory creation is performed.
CVE-2026-27771-exploit.py:441-451CVE-2026-27771-exploit.py:489-528 - Credential Handling
- Payload withheldCredential usage is limited to authenticating against the target Gitea instance; there is no exfiltration or storage outside the local process.
CVE-2026-27771-exploit.py:125-139CVE-2026-27771-exploit.py:360-383 - Registration Behavior
- Payload withheldThis is a legitimate step for obtaining authenticated access to demonstrate the vulnerability; it does not install persistence or escalate privileges beyond the created account.
CVE-2026-27771-exploit.py:151-285
What the analysis did not establish
- Evidence consists of two complete text files; no binary or omitted files. The artifact's behavior is inferred from source code analysis only; the code was not executed.
- Only the two text files (CVE-2026-27771-exploit.py and README.md) were reviewed; no binary files or other repository content were inspected.
- The review is static; no dynamic analysis or execution was performed to confirm runtime behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubportbuster1337/CVE-2026-33137
Repository PoCStars: 0Created 2026-05-25ExploitCVE-2026-331373 files
Analysis
Technical assessment
The artifact is a Python exploit script (poc.py) that performs an unauthenticated XAR import against a vulnerable XWiki REST endpoint to create or overwrite wiki pages, and includes an RCE mode that imports pages containing Groovy/Velocity payloads to execute arbitrary commands on the target server.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a README and a Python script (poc.py) that exploit CVE-2026-33137 by sending a crafted XAR file to a vulnerable XWiki REST endpoint. The script performs version detection, XAR import, and optional RCE via Groovy/Velocity payloads. All behavior is consistent with the stated vulnerability and no concealed, deceptive, or unrelated harmful actions were observed.
Classification basis and observed behavior
Classification basis
The script actively exploits the missing authorization vulnerability by constructing and sending a malicious XAR payload to the target endpoint, and includes an RCE mode that imports pages with executable code to run arbitrary commands on the server. This goes beyond detection or scanning; it exercises the vulnerability to achieve impact.
poc.py:134-168poc.py:170-239Requirements
- Target must be running a vulnerable version of XWiki Platform (prior to 16.10.17, 17.4.9, 17.10.3, 18.0.1, 18.1.0-rc-1).
poc.py:9-10 - The target's REST endpoint /wikis/{wikiName} must be reachable and accept POST requests without authentication.
poc.py:104-111 - For RCE, the target must allow guest viewing of pages or valid credentials must be supplied, and scripting/programming rights must be enabled for the viewing user.
README.md:69-72
Observed behavior
- Constructs a minimal XAR (ZIP) file containing a package descriptor and a document XML with attacker-controlled content.
poc.py:64-73 - Sends an unauthenticated POST request to the vulnerable REST endpoint to import the crafted XAR file, creating or overwriting wiki documents.
poc.py:104-111 - In RCE mode, imports pages containing Groovy and Velocity macros that execute a user-supplied command string on the server.
poc.py:75-91 - Attempts to trigger the imported RCE pages by requesting various REST and web UI paths, reporting which trigger paths are accessible.
poc.py:198-223 - Optionally verifies document creation by reading back the document metadata via the REST API.
poc.py:158-167
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldDirectly implements the described CVE-2026-33137 unauthenticated XAR import vulnerability
poc.py:104-111poc.py:64-73 - Exploit Behavior
- Payload withheldMatches the documented --rce functionality; payloads are user-specified and not hardcoded to perform unrelated actions
poc.py:75-91poc.py:170-239 - Network Targeting
- Payload withheldNo hardcoded exfiltration or callback endpoints; all network activity is directed at the user-specified target
poc.py:242-256
What the analysis did not establish
- The evidence includes only two text files (README.md and poc.py); one additional file (likely a license or similar) is omitted from the packet content, but this does not affect classification.
- The artifact's behavior is inferred from static code analysis; the code was not executed, and its actual effectiveness against a live target is not verified.
- One file (package.xml or similar) was omitted from the text evidence but is flagged as metadata-only and not analyzed; its absence does not affect the review of the provided Python source and README.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubportbuster1337/CVE-2026-33712
Repository PoCStars: 0Created 2026-05-25ExploitCVE-2026-337124 files
Analysis
Technical assessment
The artifact is a Python exploit script (exploit.py) that targets an unauthenticated SSRF vulnerability (CVE-2026-33712) in Typebot <= 3.15.2. It constructs a malicious typebot definition containing a Code block that uses the sandboxed fetch() to make arbitrary server-side requests, bypassing SSRF protections. The script supports single-URL exfiltration and bulk scanning of internal endpoints, sending retrieved data to an attacker-controlled webhook.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-33712, an unauthenticated SSRF vulnerability in Typebot. The Python script (exploit.py) sends crafted requests to a target Typebot instance to trigger the SSRF and exfiltrate data to a user-supplied webhook. The code performs only the advertised SSRF exploitation and data exfiltration; no concealed backdoor, persistence mechanism, credential theft from the operator's machine, or unrelated payload delivery was observed.
Classification basis and observed behavior
Classification basis
The script is designed to actively exploit the vulnerability by sending crafted requests that cause the server to make unauthorized internal HTTP requests and exfiltrate the results. It is not merely detecting the vulnerability; it is exercising it to achieve SSRF and data theft.
exploit.py:1-10exploit.py:127-144Requirements
- A target Typebot instance running version <= 3.15.2 with the preview chat endpoint accessible.
README.md:5-6 - An attacker-controlled webhook URL to receive exfiltrated data.
exploit.py:248-251
Observed behavior
- Sends a POST request to the vulnerable preview endpoint with a crafted JSON payload containing a Code block that executes a server-side fetch to an internal URL.
exploit.py:85-93exploit.py:35-82 - Exfiltrates the fetched internal content by sending it as a POST body to the attacker's webhook.
exploit.py:127-144 - Performs a pre-flight check to determine if the target is vulnerable, patched, or missing the endpoint before attempting exploitation.
exploit.py:96-124 - Supports scanning multiple internal endpoints listed in an endpoints.txt file.
exploit.py:185-198
Behaviors behind the backdoor verdict
Observables
- Exfiltration Webhook
- Payload withheldThe script exfiltrates fetched internal content to an attacker-controlled webhook, which is the intended purpose of the SSRF exploit.
exploit.py:127-144exploit.py:222-223 - Ssrf Payload
- Payload withheldThe script builds a typebot payload that exploits the missing SSRF validation in the preview endpoint.
exploit.py:35-82README.md:116-162 - Target Endpoint
- Payload withheldThe vulnerable endpoint targeted by the exploit.
exploit.py:87README.md:8
What the analysis did not establish
- The evidence includes only the README.md, exploit.py, and requirements.txt files. The endpoints.txt file is referenced but its content is not provided in the evidence packets.
- The analysis is based solely on static review of the provided text; the code was not executed, and its operational reliability is not verified.
- One file (endpoints.txt) was omitted from the text evidence; its content is described in README.md as a list of SSRF target URLs and is not expected to contain executable code.
- Binary or non-text media files were not present in the evidence.
- The review is limited to the static source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubportbuster1337/CVE-2026-20182
Repository PoCStars: 3Created 2026-05-22ExploitCVE-2026-201822 files
Analysis
Technical assessment
A Python exploit for CVE-2026-20182 that bypasses authentication on Cisco Catalyst SD-WAN Controller/Manager by sending crafted DTLS messages claiming to be a vHub (device_type=2), then injects an SSH public key for persistent NETCONF/SSH access.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script for CVE-2026-20182. The script performs the documented authentication bypass and SSH key injection against the stated Cisco SD-WAN target. No concealed, deceptive, or unrelated harmful behavior was observed. The script's actions are consistent with the described exploit and do not exhibit backdoor or trojan characteristics.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, executable Python script (cve-2026-20182.py) that actively exploits CVE-2026-20182 by sending crafted DTLS messages to bypass authentication and inject an SSH key for remote access. The README explicitly describes it as a 'proof-of-concept exploit' and details the exploitation steps.
README.md:3cve-2026-20182.py:1-13cve-2026-20182.py:74-168Requirements
- Python 3.7+ with cryptography library and openssl CLI
README.md:111-113 - Network access to target UDP port 12346 (vdaemon DTLS service)
README.md:17
Observed behavior
- Establishes DTLS 1.2 connection to target vdaemon service on UDP/12346
cve-2026-20182.py:79-84 - Receives CHALLENGE message (msg_type=8) from server
cve-2026-20182.py:105-111 - Sends CHALLENGE_ACK with device_type=2 (vHub) to bypass certificate verification
cve-2026-20182.py:44-47cve-2026-20182.py:114-116 - Sends HELLO message to transition peer to UP state
cve-2026-20182.py:50-51cve-2026-20182.py:144-146 - Injects SSH public key into vmanage-admin authorized_keys via MSG_VMANAGE_TO_PEER
cve-2026-20182.py:54-57cve-2026-20182.py:162-164 - Optionally verifies exploitation by connecting to NETCONF over SSH on port 830
cve-2026-20182.py:199-234
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldAll actions match the documented vulnerability exploitation steps and target the specified Cisco SD-WAN service.
cve-2026-20182.py:39-57cve-2026-20182.py:74-168 - Network Target
- Payload withheldThe script connects only to the user-supplied target on the documented vulnerable service port.
cve-2026-20182.py:79-80 - Payload
- Payload withheldThe injected key provides the documented NETCONF/SSH access as the vmanage-admin user; no other payloads or persistence mechanisms are present.
cve-2026-20182.py:54-57README.md:21-22
What the analysis did not establish
- Review is limited to the supplied text files (README.md and cve-2026-20182.py). No binary files were present. The script's runtime behavior was not dynamically analyzed; static analysis cannot guarantee the absence of logic bombs or environment-dependent behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.