Dhananjayasj
Source-scoped identity with 6 associated PoCs and 7 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
GitHubDhananjayasj/CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-
Repository PoCStars: 0Created 2026-06-10Model review verdict: Suspicious behavior.ExploitCVE-2025-248132 files
AnalysisSuspicious behavior
Technical assessment
Python script that performs remote code execution against a vulnerable Apache Tomcat instance by uploading a serialized Java payload via a partial PUT request and triggering deserialization through a crafted session cookie.
Backdoor review
Suspicious behaviorThe PoC script (CVE-2025-24813.py) contains a hardcoded, base64-encoded Java serialized payload that, when decoded, reveals an embedded reverse shell command connecting to a fixed external IP address (payload withheld:payload withheld). The script's documentation instructs the operator to generate their own payload, but the provided default payload silently executes this undisclosed callback. This constitutes a material contradiction between the documented behavior and the actual code, creating a deceptive risk for the operator.
Classification basis and observed behavior
Classification basis
The Python script actively uploads a malicious serialized object and triggers its deserialization to achieve remote code execution, which is the definition of an exploit.
CVE-2025-24813.py:30-40Requirements
- Target Tomcat default servlet must have write access enabled (readonly=false).
README.md:11 - Target must have file-based session persistence configured with default storage location.
README.md:13 - Target classpath must include a deserialization gadget library (e.g., commons-collections).
README.md:15
Observed behavior
- Decodes a hardcoded base64-encoded Java serialized payload and writes it to a local file.
CVE-2025-24813.py:22-28 - Sends an HTTP PUT request to /payload.session with a Content-Range header to upload the serialized payload into the session storage directory.
CVE-2025-24813.py:30-34 - Sends an HTTP HEAD request with a crafted JSESSIONID cookie to trigger deserialization of the uploaded session file.
CVE-2025-24813.py:39-40 - Checks for HTTP 500 response to determine if the exploit likely succeeded.
CVE-2025-24813.py:43-46
Behaviors behind the backdoor verdict
Flagged behaviors
- The PoC script includes a hardcoded base64-encoded Java serialized payload (line 22) that decodes to a command executing a reverse shell to payload withheld:payload withheld. The script's comments (lines 19-20) instruct the user to generate their own payload, but the default payload silently establishes a connection to an external, operator-uncontrolled address without disclosure.
CVE-2025-24813.py:19-22
Observables
- Ipv4 Address
- Payload withheldHardcoded reverse shell callback address embedded in the default base64-encoded payload within the PoC script.
CVE-2025-24813.py:22 - Tcp Port
- Payload withheldHardcoded reverse shell callback port embedded in the default base64-encoded payload within the PoC script.
CVE-2025-24813.py:22 - Command
- Payload withheldDecoded command from the hardcoded payload that downloads and executes a script from the attacker-controlled server, establishing a reverse shell.
CVE-2025-24813.py:22
What the analysis did not establish
- The base64 payload is hardcoded and its exact behavior (e.g., command executed) cannot be confirmed without decoding and analyzing the serialized Java object, which is outside the scope of this text-only analysis.
- The script's success depends on specific, non-default Tomcat configurations that are not verified by the script itself.
- The review does not confirm that the external IP address (payload withheld) is currently active or controlled by an attacker.
- The decoded command downloads and executes a remote script (rev.sh), but the content of that script is not included in the evidence and was not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubDhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution
Repository PoCStars: 0Created 2026-06-06Model review verdict: Suspicious behavior.ExploitCVE-2026-38443 files
AnalysisSuspicious behavior
Technical assessment
A Python script that exploits CVE-2026-3844, an unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin, by posting a malicious comment to trigger the plugin to fetch and cache a remote PHP webshell, leading to remote code execution.
Backdoor review
Suspicious behaviorThe PoC script (CVE-2026-3844.py) exploits a disclosed arbitrary file upload vulnerability in the Breeze Cache WordPress plugin. However, it contains a hardcoded default payload URL pointing to a third-party GitHub Gist (im-hanzou) and a hardcoded success verification string, which are used automatically without operator configuration. The script's documentation and help text present the payload as operator-configurable, but the default behavior silently fetches and executes a remote webshell from an external, unvetted source. This material contradiction between the presented configurability and the automatic use of a hardcoded external payload creates concern, though direct evidence of concealed harm is not established.
Classification basis and observed behavior
Classification basis
The script actively performs the steps to upload and execute a remote payload on a vulnerable target, including sending a malicious comment, waiting for caching, and verifying code execution. This constitutes an exploit, not merely a scanner or writeup.
CVE-2026-3844.py:119-186CVE-2026-3844.py:202-273Requirements
- The 'Host Files Locally - Gravatars' option must be enabled in Breeze Cache settings.
CVE-2026-3844.py:234-235 - The target WordPress site must have comments enabled on at least one post.
CVE-2026-3844.py:139 - A remote payload (e.g., a PHP webshell) must be hosted on an accessible HTTP server.
CVE-2026-3844.py:203
Observed behavior
- Checks if the target is running a vulnerable version of Breeze Cache (≤ 2.4.4) by fetching readme.txt.
CVE-2026-3844.py:93-117 - Sends a POST request to /wp-comments-post.php with a crafted comment containing an img srcset tag pointing to a remote payload URL.
CVE-2026-3844.py:137-141 - Waits for the Breeze plugin to fetch and cache the remote file, then checks for its presence in the gravatars cache directory.
CVE-2026-3844.py:152-164 - Verifies successful exploitation by checking for a predefined verification string in the uploaded file's response.
CVE-2026-3844.py:169-170 - Tests the uploaded webshell by sending a command and checking the response.
CVE-2026-3844.py:188-200
Behaviors behind the backdoor verdict
Flagged behaviors
- The script defines a hardcoded DEFAULT_PAYLOAD pointing to an external GitHub Gist (user im-hanzou) and a hardcoded DEFAULT_SUCCESS_STRING. These are used automatically in the exploit() function without requiring the operator to supply a payload, contradicting the script's own help text which presents the payload as an optional argument.
CVE-2026-3844.py:203-204CVE-2026-3844.py:212CVE-2026-3844.py:238
Observables
- Url
- Payload withheldHardcoded default payload URL used when the operator does not supply a custom payload. The payload is fetched and stored on the target server.
CVE-2026-3844.py:203 - String
- Payload withheldHardcoded default success verification string (hex for 'CVE-2026-3844') used to confirm successful exploitation when the default payload is used.
CVE-2026-3844.py:204
What the analysis did not establish
- One file (likely a Dockerfile or similar) was omitted from the text evidence; its content is not available for analysis.
- The README.md file is truncated at line 47, so the full exploitation guide and Docker lab details are not fully visible.
- The content of the hardcoded default payload (CVE-2026-3844.php) is not included in the evidence, preventing analysis of its behavior.
- The repository contains one unclassified file (likely the Docker lab) that was not inspected, but it is not part of the PoC script's execution path.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubDhananjayasj/CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction
Repository PoCStars: 0Created 2026-06-04ExploitCVE-2024-16982 files
Analysis
Technical assessment
Python script that performs unauthenticated time-based blind SQL injection against the NotificationX WordPress plugin to extract the admin username and password hash.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script for CVE-2024-1698. The script performs a time-based blind SQL injection against a hardcoded target URL to extract the admin username and password hash from a WordPress database. All behavior is consistent with the stated purpose of demonstrating the SQL injection vulnerability. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete Python script (exploit.py) that actively exploits CVE-2024-1698 by sending crafted HTTP requests to extract sensitive data from a vulnerable target. The README describes it as an exploit and provides usage instructions.
exploit.py:1-71README.md:7Requirements
- Target WordPress site with NotificationX plugin version <= 2.8.2
README.md:13 - Python 3.6+ with requests library
README.md:38-39
Observed behavior
- Sends POST requests to /wp-json/notificationx/v1/analytics with a malicious 'type' parameter containing a time-based blind SQL injection payload
exploit.py:19-22 - Determines admin username length by injecting IF(LENGTH(...)=N, SLEEP(delay), null) and measuring response time
exploit.py:18-29 - Extracts admin username character by character using ASCII(SUBSTRING(...)) with SLEEP-based timing
exploit.py:32-49 - Extracts admin password hash using the same time-based blind technique on the user_pass column
exploit.py:52-71
Behaviors behind the backdoor verdict
Observables
- Hardcoded Target Url
- Payload withheldThe exploit script targets a local/private IP address, indicating it is intended for a controlled test environment rather than a live attack.
exploit.py:9 - Sql Injection Payload
- Payload withheldThe payload extracts the admin username length via time-based blind SQL injection, consistent with the described vulnerability.
exploit.py:21 - Sql Injection Payload
- Payload withheldThe payload extracts the admin username character by character, consistent with the described vulnerability.
exploit.py:38 - Sql Injection Payload
- Payload withheldThe payload extracts the admin password hash character by character, consistent with the described vulnerability.
exploit.py:58
What the analysis did not establish
- Only the two text files (README.md and exploit.py) were reviewed; no binary or other files were present in the evidence packet.
- The review does not assess whether the exploit works as claimed or is safe to execute in any environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubDhananjayasj/CVE-2026-34156-NocoBase-Sandbox-Escape-via-Workflow-Execution-Vulnerability-
Repository PoCStars: 0Created 2026-06-02CVE-2026-341562 files
GitHubDhananjayasj/RRAS-VULNERABILITY-CVE-2026-25172-CVE-2026-25173-CVE-2026--26111
Repository PoCStars: 0Created 2026-05-30ScannerCVE-2026-25172CVE-2026-251732 files
Analysis
Technical assessment
The artifact provides a lab guide and a Python script to simulate a malicious RRAS server. The script listens on port 445 and sends a crafted payload intended to trigger an integer overflow, but it does not contain a working exploit; it only sends a static payload and instructs the user to check for a crash, functioning as a vulnerability scanner/detector.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README with lab setup instructions and a Python script (rras_exploit.py) that simulates a malicious RRAS server to trigger an integer overflow. The script listens on port 445, crafts a payload with a max DWORD and padding, and sends it to connecting clients. No backdoor, credential theft, persistence, or unrelated payload is present. The behavior is consistent with the stated educational purpose of demonstrating the CVE.
Classification basis and observed behavior
Classification basis
The Python script sends a crafted payload to trigger a vulnerability but does not achieve code execution or demonstrate a working exploit. It relies on manual observation of a crash, which is characteristic of a scanner/detector rather than an exploit.
rras_exploit.py:7-13rras_exploit.py:30Requirements
- An authenticated domain user or administrator must connect the RRAS management console to the attacker's server.
README.md:8 - Victim machine must be an unpatched Windows 11 build lower than 26100.7982 or 26200.7982.
README.md:18
Observed behavior
- Starts a TCP server on port 445 and sends a static payload consisting of a header, a max DWORD value (0xFFFFFFFF), and 1024 bytes of padding.
rras_exploit.py:4-13rras_exploit.py:15-31 - Instructs the user to check the victim machine for a crash or unexpected behavior after sending the payload.
rras_exploit.py:30
Behaviors behind the backdoor verdict
Observables
- Network Listener
- Payload withheldThe script binds to all interfaces on port 445 to accept connections and send a crafted payload, simulating a malicious server for the described vulnerability.
rras_exploit.py:4-5rras_exploit.py:19 - Crafted Payload
- Payload withheldThe payload is designed to trigger an integer overflow in the RRAS management tool, matching the described CVE exploitation scenario.
rras_exploit.py:9-12
What the analysis did not establish
- The script uses a hardcoded payload and does not adapt to target versions or implement a full exploit chain.
- The README describes a lab setup but does not provide a complete, automated exploit; it requires manual steps and observation.
- Only the two text files (README.md and rras_exploit.py) were provided and reviewed; no other files from the repository were inspected.
- Binary content was not present in the evidence, so no binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubDhananjayasj/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability
Repository PoCStars: 0Created 2026-05-30ExploitCVE-2024-214132 files
Analysis
Technical assessment
The artifact is a Python script that sends a specially crafted email containing a file:// link with an exclamation mark, designed to trigger CVE-2024-21413 in Microsoft Outlook and leak the victim's NetNTLMv2 hash to an attacker-controlled SMB server.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python script and a README for a CVE-2024-21413 proof-of-concept. The script sends an email with a crafted file:// link designed to trigger the Outlook vulnerability and leak NetNTLMv2 hashes. No backdoor, concealed operator-directed harm, or unrelated payload was observed. The script's behavior is consistent with the stated PoC purpose.
Classification basis and observed behavior
Classification basis
The Python script actively sends a malicious email containing the vulnerability trigger (file:// link with !) to a victim, which is intended to exercise the vulnerability and leak credentials, not merely detect or report it.
CVE-2024-21413.py:34CVE-2024-21413.py:50Requirements
- Attacker must have valid SMTP server credentials to send the malicious email.
CVE-2024-21413.py:60-61 - Attacker must set up an SMB listener (e.g., Responder) to capture the victim's hash.
README.md:11 - Victim must open or preview the email in a vulnerable version of Microsoft Outlook.
README.md:16-17
Observed behavior
- Constructs an email with an HTML body containing a file:// link with an exclamation mark (!) pointing to an attacker-specified URL.
CVE-2024-21413.py:30-37 - Authenticates to an SMTP server and sends the crafted email to a recipient.
CVE-2024-21413.py:44-50 - The email is designed to cause Outlook to make an SMB connection to the attacker's server, leaking the victim's NetNTLMv2 hash.
README.md:18-20
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe script connects to a user-supplied SMTP server to send the exploit email. This is required for the PoC and does not represent unauthorized exfiltration.
CVE-2024-21413.py:45-50 - File Path
- Payload withheldThe HTML email body contains a file:// link with an exclamation mark, which is the core mechanism of CVE-2024-21413 to trigger an SMB connection and leak hashes.
CVE-2024-21413.py:34
What the analysis did not establish
- The evidence does not include the attacker's SMB listener component; only the email-sending script is provided.
- The README describes the attack flow but does not provide executable code for the SMB listener or hash cracking.
- Only the two text files (CVE-2024-21413.py and README.md) were reviewed; no binary files were present or analyzed.
- The review does not assess the safety of executing the script or the legitimacy of the SMTP server credentials used.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.