BlackSnufkin
Source-scoped identity with 3 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubBlackSnufkin/AxHunter
Repository PoCStars: 10Created 2026-08-05ExploitCVE-2026-15430CVE-2026-360936 files
Analysis
Technical assessment
The artifact is a Rust workspace containing two exploit PoCs for Wellbia XIGNCODE3 anti-cheat drivers. AxHunter_v1 targets xhunter1.sys (CVE-2026-3609) and AxHunter_v2 targets xhunter2.sys (CVE-2026-15430). Both PoCs bypass driver authentication gates to obtain kernel-minted PROCESS_ALL_ACCESS handles, enabling credential dumping from lsass.exe, PPL-protected process termination, local privilege escalation to SYSTEM, and kernel-mode code injection.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files constitute a proof-of-concept exploit for two known CVEs in the XIGNCODE3 anti-cheat driver. The code implements documented exploit primitives (privilege escalation, credential dumping, process termination, code injection) against the vulnerable driver. No concealed backdoor, deceptive payload, or unrelated operator-directed harm was observed in the supplied source code.
Classification basis and observed behavior
Classification basis
The artifact's primary stated purpose is to exploit vulnerabilities in the xhunter driver family. The README explicitly describes the code as 'PoCs' and the source code implements full exploitation chains including authentication bypass, handle acquisition, credential dumping, process termination, privilege escalation, and code injection. The code is designed to be compiled and executed to achieve these effects, not merely to detect or report the vulnerability.
README.md:3axhunter_v1/src/main.rs:1axhunter_v2/src/main.rs:1Requirements
- The vulnerable xhunter1.sys or xhunter2.sys driver must be loaded and accessible via a device path.
axhunter_v1/src/main.rs:85-90axhunter_v2/src/main.rs:141-144 - The attacker must have local, unprivileged code execution on the target Windows system.
README.md:3
Observed behavior
- Bypasses the driver's authentication gate by sending specific IOCTL commands (cmd 777 + cmd 775 for v1; cmd 777 + cmd 779 + cmd 775 for v2) to set allowlist flags.
axhunter_v1/src/main.rs:93-96axhunter_v2/src/main.rs:3-13 - Obtains a kernel-minted PROCESS_ALL_ACCESS handle on any process, including PPL-protected ones, via cmd 785.
axhunter_v1/src/main.rs:6-7axhunter_v2/src/main.rs:23-25 - Dumps credentials (NT and SHA1 hashes, WDigest plaintext) from lsass.exe by reading its memory through the driver.
axhunter_v1/src/main.rs:11axhunter_v2/src/main.rs:17 - Terminates PPL-protected processes (e.g., MsMpEng.exe) by stomping their handles via cmd 800.
axhunter_v1/src/main.rs:12axhunter_v2/src/main.rs:18-20 - Escalates privileges to SYSTEM by injecting shellcode into a SYSTEM process (e.g., winlogon.exe) using the obtained handle.
axhunter_v1/src/main.rs:13-14axhunter_v2/src/main.rs:21-25 - Performs kernel-mode code injection via cmd 820, where the driver allocates RWX memory and creates a user thread in the target process.
axhunter_v1/src/main.rs:15-16axhunter_v2/src/main.rs:26-30
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the stated purpose of the artifact and matches the associated CVE descriptions. The behavior is consistent with a normal exploit PoC.
README.md:3axhunter_v1/src/main.rs:1-23axhunter_v2/src/main.rs:1-37 - Binary Limitation
- Payload withheldThese are the vulnerable driver binaries and a supporting DLL. Their content is opaque to this review, but their presence is expected for a driver exploit PoC.
README.md:19
What the analysis did not establish
- Three binary files (xhunter1.sys, xhunter2.sys, wbmf_module.dll) are present but were not inspected; their content is flagged as binary and only metadata was analyzed.
- Only 8 of 36 total files were selected for text analysis; 25 text files were omitted from the evidence packet.
- The analysis is based solely on the provided source code and metadata; the code was not executed, and its actual runtime behavior or reliability cannot be confirmed.
- Three binary files (xhunter1.sys, xhunter2.sys, wbmf_module.dll) were not analyzed and could contain additional behavior not visible in the source code.
- Only 8 of 36 total files were reviewed; the remaining 28 files were omitted from the evidence packet and their content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBlackSnufkin/CredsHunter
Repository PoCStars: 30Created 2026-05-12ExploitCVE-2026-360914 files
Analysis
Technical assessment
A Rust-based LSASS credential dump exploit that leverages a PPL-bypassing handle leak (CVE-2026-3609) in the xhunter1.sys kernel driver. It opens the driver, sends command 785 to obtain a kernel-minted PROCESS_ALL_ACCESS handle to lsass.exe, and then uses that handle to read and decrypt NTLM/SHA1 hashes and WDigest plaintext credentials.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (Cargo.toml, README.md, src/main.rs) describe and implement a proof-of-concept exploit for CVE-2026-3609, which leverages a vulnerable kernel driver to dump LSASS credentials. The code performs only the documented credential-dumping behavior. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed in the supplied text evidence.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional exploit. It actively exercises the CVE-2026-3609 vulnerability by sending a specific command to the vulnerable driver to obtain a privileged handle, and then uses that handle to perform a credential dump from the LSASS process. The README explicitly describes it as a 'proof-of-concept' and details the exploitation chain, while the source code in main.rs implements the full attack flow.
README.md:5README.md:7src/main.rs:1-8src/main.rs:38-108Requirements
- The vulnerable xhunter1.sys driver must be loaded as a kernel service on the target system.
README.md:36-41 - The attacker must have the ability to execute the compiled CredsHunter.exe binary on the target.
README.md:24-30
Observed behavior
- Opens a handle to the xhunter1.sys driver device via CreateFile.
README.md:88 - Sends a WriteFile command (785) to the driver to obtain a kernel-minted PROCESS_ALL_ACCESS handle to the lsass.exe process, bypassing PPL.
README.md:89 - Uses the obtained handle to read memory from lsass.exe, either via ReadProcessMemory or a driver-side memcpy fallback (command 787).
README.md:90 - Locates and extracts the 3DES encryption key and IV from the remote lsass.exe process.
README.md:91 - Walks the LogonSessionList in lsass.exe memory, decrypts credential blobs, and prints NTLM and SHA1 hashes for active logon sessions.
README.md:92 - Attempts to dump WDigest plaintext credentials from memory.
src/main.rs:94-105
Behaviors behind the backdoor verdict
Observables
- Vulnerable Driver Inclusion
- Payload withheldThe repository includes the vulnerable signed driver binary to enable end-to-end reproduction of the exploit, as stated in README.md lines 16-17.
README.md:16-17 - Credential Dumping Behavior
- Payload withheldThe main.rs code opens the vulnerable driver, obtains a handle to lsass.exe, extracts the 3DES key, and dumps NTLM/SHA1 hashes and WDigest plaintexts. This matches the documented exploit behavior.
src/main.rs:38-108
What the analysis did not establish
- The analysis is based on the provided text files (Cargo.toml, README.md, src/main.rs). The remaining 11 files in the repository, including the core driver interaction logic (driver.rs, lsa.rs, logon.rs, etc.) and the vulnerable binary (xhunter1.sys), were not provided as text and were not analyzed.
- The evidence packet indicates 'complete_artifact_coverage: false' and 'binary_files_uninspected: 1', confirming that not all repository content was inspected.
- The binary file xhunter1.sys was not analyzed; only its metadata is reported.
- 10 additional text files in the repository were not included in the evidence packet and were not reviewed.
- The review is limited to static analysis of the supplied text content; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.