Chocapikk

Classification basis

The artifact contains a complete Python script (exploit.py) that actively exploits the vulnerability by sending HTTP requests to leak a token, exchange it for a bearer token, and access protected resources. The README describes it as an 'Account takeover + data dump' and provides usage examples showing exploitation.

Requirements

• login_with_mail_link_enable must be enabled in admin settingsREADME.md:30exploit.py:17
• A valid registered email addressREADME.md:31exploit.py:18

Observed behavior

• Sends an unauthenticated POST request to /api/v1/passport/auth/loginWithMailLink with a JSON body containing the target emailexploit.py:74-77
• Extracts the magic link token from the HTTP response bodyexploit.py:82-83
• Exchanges the leaked verify token at /api/v1/passport/auth/token2Login to obtain a bearer tokenexploit.py:89-92
• Uses the obtained bearer token to authenticate and dump user data from multiple API endpointsexploit.py:43-56exploit.py:101-110

Observables

Exploit Behavior

Payload withheldThe script implements the described CVE-2026-39912 vulnerability: POST to loginWithMailLink, extract token from response, exchange at token2Login, then enumerate user endpoints.exploit.py:72-99exploit.py:101-110

Network Target

Payload withheldThe script takes a target URL and email as command-line arguments; no hardcoded exfiltration endpoint or unrelated network activity is present.exploit.py:114-118

Output Behavior

Payload withheldThe script prints or saves the obtained auth token and enumerated user data; no evidence of exfiltration to a remote server.exploit.py:125-132

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2025-71243 by sending crafted HTTP requests to inject and execute arbitrary PHP code on a remote target, achieving remote code execution. It includes modes for checking vulnerability, executing single commands, and providing an interactive shell.

Requirements

• Target must have a publicly accessible page containing a saisies-powered form (e.g., via Formidable plugin).README.md:28
• Saisies plugin version must be between 5.4.0 and 5.11.0 inclusive.exploit.py:57

Observed behavior

• Sends a POST request with a crafted `_anciennes_valeurs` parameter containing a PHP code injection payload that breaks out of an HTML attribute and executes arbitrary PHP.exploit.py:79-80exploit.py:184-186
• Executes shell commands by base64-encoding them and injecting a `system(base64_decode(...))` call, then extracts the command output from the HTTP response.exploit.py:188-193
• Provides an interactive shell loop that repeatedly prompts for commands and prints the output.exploit.py:195-208
• Includes a crawler that starts from a sitemap page and follows internal links to automatically discover pages containing saisies forms.exploit.py:145-180

Observables

Network Connection

Payload withheldThe exploit sends HTTP requests only to the target URL provided via the -u argument and to the optional proxy specified via --proxy. No hardcoded external hosts are contacted.exploit.py:60-70exploit.py:211-222

Command Execution

Payload withheldThe script constructs a payload that injects PHP code into the target SPIP application. The injected code executes a base64-encoded shell command provided by the user via -c or interactive input. This is the advertised exploit behavior.exploit.py:79-80exploit.py:188-193

Classification basis

The primary artifact poc.go contains complete code that actively exploits the vulnerability by connecting to a target, injecting a malicious environment variable to bypass authentication, and providing an interactive shell. This is exploitation, not mere detection or scanning.

Requirements

• Target running vulnerable GNU Inetutils telnetd (versions 1.9.3 through 2.7)README.md:9
• Network access to the target telnet portpoc.go:40-44

Observed behavior

• Connects to a specified host and port via TCPpoc.go:44
• Sends telnet protocol commands to negotiate NEW-ENVIRON and ENVIRON optionspoc.go:55-56
• Injects the environment variable USER with value '-f root' to trigger authentication bypasspoc.go:54poc.go:142-153
• Checks for absence of login prompt and presence of WILL ECHO to confirm successful bypasspoc.go:67-75
• Executes 'id' command and verifies 'uid=' in output to confirm shell accesspoc.go:77-83
• Provides an interactive shell session, reading commands from stdin and sending them to the targetpoc.go:92-109

Observables

Exploit Behavior

Payload withheldThis is the exact behavior described in the README and CVE advisory for CVE-2026-24061. It is the intended purpose of the PoC.poc.go:54poc.go:142-153poc.go:88

Target Environment

Payload withheldThe Dockerfile sets up a lab environment for testing the exploit, consistent with the README instructions. It does not contain any backdoor or unrelated payload.Dockerfile:1-36

Classification basis

The artifact includes Metasploit modules (windmill_path_traversal_rce.rb, windmill_sqli_rce.rb) that actively exploit vulnerabilities to achieve remote code execution. The README describes these as 'exploits' and provides usage examples for obtaining shells. The code is intended to exercise the vulnerability, not merely detect it.

Requirements

• Target running vulnerable Windmill (v1.309.0 - v1.603.2) or Nextcloud Flow (v1.0.0 - v1.2.2)README.md:23-24
• Network access to the target's Windmill API endpointREADME.md:195

Observed behavior

• Sends crafted HTTP requests with path traversal sequences (e.g., '../') to the vulnerable get_log_file endpoint to read arbitrary files like /etc/passwd.README.md:294
• Leaks credentials by reading /proc/1/environ for SUPERADMIN_SECRET, windmill_users_config.json for tokens, or PostgreSQL data files for jwt_secret.README.md:140-144
• Uses leaked credentials or forged JWT to authenticate to the Windmill API and execute arbitrary commands via the job execution feature, achieving remote code execution.metasploit/modules/exploits/linux/http/windmill_path_traversal_rce.rb:115-117
• The SQL injection module authenticates as a low-privileged user, exploits a SQLi in the addowner endpoint to extract jwt_secret, forges an admin JWT, and escalates privileges to superadmin for RCE.metasploit/modules/exploits/linux/http/windmill_sqli_rce.rb:147-165

Observables

Exploit Behavior

Payload withheldThis is the documented vulnerability exploitation path; no hidden behavior detected.README.md:107-110metasploit/modules/exploits/linux/http/windmill_path_traversal_rce.rb:121-124

Exploit Behavior

Payload withheldMatches the documented attack chain; no evidence of exfiltration to an attacker-controlled destination beyond the module's normal operation.metasploit/modules/exploits/linux/http/windmill_path_traversal_rce.rb:134-145

Exploit Behavior

Payload withheldThe module executes attacker-supplied commands on the target; this is the stated purpose of the exploit.metasploit/modules/exploits/linux/http/windmill_path_traversal_rce.rb:115-117

Exploit Behavior

Payload withheldDocumented authenticated SQLi attack chain; no hidden queries or data exfiltration beyond the described escalation.metasploit/modules/exploits/linux/http/windmill_sqli_rce.rb:147-165

Opsec Technique

Payload withheldDescribed as an OPSEC feature to remove forensic evidence; this is part of the exploit's self-destruct mechanism, not a backdoor.README.md:263-275

Classification basis

The code actively exploits the hardcoded token vulnerability to authenticate and perform privileged operations (ServerInfo, ListVolumes, ListDir, ReadAll) on a target RustFS instance. It is self-described as an 'Exploit' and includes a main function that executes the full exploitation chain when run with a target host and port.

Requirements

• Network access to a vulnerable RustFS gRPC service portmain.go:121-123
• Knowledge of the hardcoded token 'payload withheld'main.go:27

Observed behavior

• Establishes an unencrypted gRPC connection to the target host and portmain.go:121-123
• Authenticates to the gRPC service by setting the 'authorization' metadata header to the hardcoded token 'payload withheld'main.go:128main.go:179
• Calls the ServerInfo RPC method to retrieve and decode server properties (MsgPack-decoded base64 data)main.go:208-237
• Discovers available disks from the ServerInfo response or falls back to a default listmain.go:239-275
• Lists volumes on each discovered disk via the ListVolumes RPC methodmain.go:305-335
• Recursively explores directories on each volume using ListDir and reads file contents via ReadAll, printing JSON data or file sizesmain.go:386-439main.go:362-384

Observables

Hardcoded Credential

Payload withheldThe exploit uses the publicly known hardcoded token to authenticate to the target gRPC service, consistent with the CVE description.main.go:27main.go:128main.go:179

Exploit Behavior

Payload withheldThe exploit calls ServerInfo, ListVolumes, ListDir, and ReadAll RPC methods to discover and exfiltrate data from the target. This matches the stated CVE impact of unauthenticated file read/write operations.main.go:208-237main.go:305-335main.go:337-360main.go:362-384

Classification basis

The artifact contains a complete, automated Python script (exploit.py) that actively exploits CVE-2025-67494 by sending a crafted request to trigger SSRF, capturing a leaked token, and using it to access protected API resources. The README explicitly describes it as an 'Automated exploit' and provides usage instructions for running the exploit against a target.

Requirements

• Target ZITADEL instance running a vulnerable version (4.0.0-rc.1 through 4.7.0) with the Login UI V2 accessible.README.md:10-11
• Outbound internet access from the attacker machine to payload withheld for OOB token capture.exploit.py:23

Observed behavior

• Creates a payload withheld URL to receive out-of-band HTTP requests.exploit.py:20-33
• Sends an unauthenticated GET request to /ui/v2/login with a malicious x-zitadel-forward-host header pointing to the payload withheld domain.exploit.py:93-106
• Polls payload withheld API to retrieve the SSRF-induced request and extracts the leaked Bearer token from the Authorization header.exploit.py:35-87
• Uses the stolen Bearer token to query ZITADEL Management API endpoints (IAM info, org info, users, projects, members, domains).exploit.py:309-333

Observables

Exploit Behavior

Payload withheldThe exploit sends a request with the x-zitadel-forward-host header to trigger SSRF, polls payload withheld for the leaked Bearer token, and uses it to query the ZITADEL Management API. This matches the described vulnerability and exploit purpose.exploit.py:93-106exploit.py:35-68exploit.py:70-87exploit.py:108-128exploit.py:130-177

External Service Usage

Payload withheldThe script creates a payload withheld URL to receive the SSRF callback and extract the Bearer token. This is a standard OOB technique for blind SSRF exploitation and is explicitly documented in the README.exploit.py:20-33README.md:141-143

Dependency

Payload withheldThe script imports from pwn import log, which is part of the payload withheld library commonly used in CTF and exploit development for logging. It is a legitimate dependency for this type of tool.exploit.py:11pyproject.toml:8

Classification basis

The artifact is a README.md containing a detailed technical analysis report. It describes backdoor code and malware behavior but does not include any executable exploit or scanner code. The report itself is a writeup.

Requirements

• Victim must clone and execute the backdoored React2shell-scanner repository.README.md:5

Observed behavior

• The report describes a backdoor function _initialize_runtime_environment() that executes mshta.exe with a remote URL upon import.README.md:79-93
• The report analyzes a multi-stage HTA malware that collects system information, targets cryptocurrency wallets, and propagates via USB.README.md:129-358
• The report provides YARA and Sigma detection rules for the backdoor and malware.README.md:549-576

Observables

Documentation

Payload withheldThe artifact is a text report describing a backdoor in an external repository. It contains no executable code or instructions to run a PoC.README.md:1-765

Classification basis

The artifact contains a complete Python script (exploit.py) that actively exploits CVE-2025-34299 by uploading a PHP reverse shell payload and executing it to gain remote code execution, which is the definition of an exploit.

Requirements

• Target running Monsta FTP <= 2.11 with accessible API endpointREADME.md:1
• Attacker must be able to run a malicious FTP server reachable by the targetexploit.py:65-88
• Attacker must have a listener reachable by the target for reverse shellexploit.py:30-63

Observed behavior

• Starts a malicious FTP server hosting a PHP reverse shell payloadexploit.py:65-88
• Sends an unauthenticated POST request to the Monsta FTP API to download the payload from the malicious FTP server to a web-accessible pathexploit.py:108-132
• Triggers the uploaded PHP file via HTTP GET to execute the reverse shell and self-deleteexploit.py:140-148
• Establishes an interactive reverse shell using pwntoolsexploit.py:52-63

Observables

Reverse Shell Payload

Payload withheldThe payload is a standard PHP reverse shell that connects back to the attacker-controlled listener. It is generated dynamically with attacker-supplied lhost and lport.exploit.py:72

Listener

Payload withheldThe listener is the attacker's endpoint for receiving the reverse shell connection. It is a standard component of the documented exploit.exploit.py:30-63

Malicious Ftp Server

Payload withheldThe FTP server is used to deliver the malicious PHP file to the vulnerable Monsta FTP instance via the downloadFile action. This is the core of the documented exploit.exploit.py:65-88