itres-labs
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubitres-labs/CVE-2023-3350
Repository PoCStars: 0Created 2026-07-28ExploitCVE-2023-33503 files
Analysis
Technical assessment
The artifact contains a C# program (CVE-2023-3350.cs) that implements AES-CBC decryption using hardcoded, predictable key and IV material derived from a username. The README describes an attack chain where an unauthenticated user downloads application logs and then uses this decryption routine to recover plaintext passwords from logged ciphertext. The code is a functional decryption tool intended to exercise the cryptographic vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a C# decryption utility and a README documenting CVE-2023-3350. The code performs AES-CBC decryption of a hardcoded ciphertext using hardcoded key/IV material. No backdoor, concealed operator-directed harm, persistence, credential exfiltration, or unrelated payload is present. The artifact is a straightforward proof-of-concept demonstrating the documented cryptographic weakness.
Classification basis and observed behavior
Classification basis
The C# file is a complete, compilable program that performs AES-CBC decryption of a hardcoded ciphertext using predictable key material. The README explicitly describes it as part of an attack chain to recover plaintext passwords. This is code intended to exercise the vulnerability, not merely detect it, making it an exploit.
CVE-2023-3350.cs:1-34README.md:45-56Requirements
- Obtain Base64-encoded AES-CBC ciphertext of a password from application logs.
README.md:6-8README.md:47-53 - Know the username associated with the ciphertext to derive the correct key and IV.
README.md:28-30README.md:67-69
Observed behavior
- The C# program defines a static AES-CBC decryptor with a hardcoded key and IV derived from a username pattern.
CVE-2023-3350.cs:6-7 - The Main method demonstrates decryption of a hardcoded Base64 ciphertext string and prints the resulting plaintext.
CVE-2023-3350.cs:9-11 - The DecryptAES method performs Base64 decoding and AES-CBC decryption using the static key and IV, returning the plaintext string.
CVE-2023-3350.cs:14-28
Behaviors behind the backdoor verdict
Observables
- Hardcoded Ciphertext
- Payload withheldThe Main method decrypts this Base64 string to demonstrate the vulnerability.
CVE-2023-3350.cs:10 - Hardcoded Key Material
- Payload withheldThe key and IV are hardcoded ASCII strings, consistent with the documented predictable key derivation.
CVE-2023-3350.cs:6-7
What the analysis did not establish
- One file (likely a .gitignore or similar) was omitted from the text evidence; its content is not material to classification.
- The hardcoded ciphertext in the C# file is redacted ('payload withheld'), so the exact decrypted output cannot be verified from the evidence alone.
- One file (metadata-only) was omitted from text review; its content is unknown but flagged as non-text and not analyzed.
- Binary content was not inspected; the review is limited to the supplied readable text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubitres-labs/CVE-2025-1868
Repository PoCStars: 2Created 2026-01-03ScannerCVE-2025-18689 files
Analysis
Technical assessment
A Dockerized PHP application that acts as an HTTP listener to detect NTLM credential leakage from Advanced IP/Port Scanner. It triggers an NTLM handshake and logs the domain, user, and workstation from NTLM Type 3 messages without exploiting the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (Dockerfile, README.md, run.sh) implement a simple PHP-based NTLM handshake tester for CVE-2025-1868. No backdoor, deceptive payload, or concealed harmful behavior is present. The code sets up a logging endpoint, does not execute hidden commands, and does not exfiltrate data beyond the stated purpose.
Classification basis and observed behavior
Classification basis
The artifact is a passive listener that detects and logs NTLM credential leakage; it does not actively exploit the vulnerability to gain unauthorized access or execute code. The README explicitly states it 'does not validate passwords' and 'only logs claimed identity and request metadata', which is consistent with a scanner/detector.
README.md:1-9Requirements
- A vulnerable instance of Advanced IP Scanner or Advanced Port Scanner must initiate a network scan that sends NTLM hashes to the listener.
README.md:1 - The listener must be reachable on port 80 by the scanning host.
README.md:11
Observed behavior
- Starts an Apache web server with PHP that listens on port 80.
Dockerfile:1-18run.sh:36-41 - Receives HTTP requests and triggers an NTLM handshake by responding with a 401 Unauthorized and WWW-Authenticate: NTLM header.
README.md:3 - Parses NTLM Type 3 messages to extract and log the claimed domain, user, and workstation.
README.md:3 - Logs extracted identity information and request metadata to a file.
README.md:7
Behaviors behind the backdoor verdict
Observables
- Log File Creation
- Payload withheldThe application logs NTLM identity claims and request metadata to this file, consistent with the stated diagnostic purpose.
Dockerfile:16README.md:3-7 - Port Binding
- Payload withheldThe README and run.sh require port 80 for the HTTP listener, which is necessary for the NTLM handshake interception scenario described in the CVE.
README.md:11run.sh:22-24 - Privilege Escalation
- Payload withheldrun.sh uses sudo to bind to port 80 when not running as root. This is a standard requirement for low port binding and does not indicate malicious intent.
run.sh:36-38
What the analysis did not establish
- The evidence does not include the PHP source code (src/index.php), which is the core logic for NTLM handshake and parsing. Only Dockerfile, README, and run.sh are provided.
- The artifact's behavior is inferred from documentation; the actual implementation of NTLM message parsing is not visible in the supplied files.
- The main PHP application file (src/index.php) is not included in the supplied evidence; only Dockerfile, README.md, and run.sh were reviewed.
- Six additional text files in the repository were omitted from the evidence packet and were not reviewed.
- No binary files were identified, so binary analysis was not performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubitres-labs/CVE-2025-31702
Repository PoCStars: 10Created 2025-10-29ScannerCVE-2025-317025 files
Analysis
Technical assessment
The repository contains Python scripts for decrypting device configuration blobs, generating authentication codes, and brute-forcing device serial numbers via the Dahua P2P cloud service. The scripts interact with live infrastructure to probe for valid serial numbers, which is a scanning activity to identify exposed devices rather than exploiting a vulnerability on a target system.
Backdoor review
No backdoor observed in reviewed code
The repository contains four Python scripts and a README that implement research tools for CVE-2025-31702, a Dahua privilege escalation vulnerability. The scripts perform AES decryption of device data, generate authentication codes, and brute-force device serial numbers via the vendor's P2P infrastructure. All behavior is consistent with the stated defensive research purpose: decrypting local device files, replicating authentication logic, and probing vendor servers to identify valid serial numbers. No concealed executable behavior, persistence mechanisms, credential exfiltration to attacker-controlled infrastructure, or unrelated payloads were observed. The code is plaintext Python with no obfuscation.
Classification basis and observed behavior
Classification basis
The primary artifact is a scanner. The dahua-sn-brute2.py script systematically probes the Dahua P2P cloud service to identify valid device serial numbers by checking HTTP 200 responses. This is a detection/enumeration activity, not an exploitation of the CVE-2025-31702 vulnerability (which involves accessing restricted data via a crafted HTTP request after obtaining normal user credentials). The README explicitly states the code is for 'defensive use' and 'validation'.
dahua-sn-brute2.py:1-9dahua-sn-brute2.py:133-184README.md:11Requirements
- Requires a fixed 10-character serial number prefix to brute-force.
dahua-sn-brute2.py:236 - Requires hardcoded cloud service credentials (USERNAME, USERKEY, RANDSALT) to authenticate with the Dahua P2P server.
dahua-sn-brute2.py:28-30 - Requires network access to www.easy4ipcloud.com on port 8800 and subsequent P2P servers.
dahua-sn-brute2.py:25-26
Observed behavior
- Decrypts Account1SecEData files using a derived AES-256-ECB key based on device class and serial number.
dahua-ac1secedata2.py:16-30 - Generates an authentication code by hashing a formatted blob containing device serial, timestamp, email, and a random hex string.
dahua-generatecode2.py:13-33 - Probes the Dahua P2P cloud service to enumerate valid device serial numbers by sending HTTP requests to /online/p2psrv/{serial} and /probe/device/{serial} endpoints.
dahua-sn-brute2.py:133-184 - Saves discovered valid serial numbers and probe responses to a local file.
dahua-sn-brute2.py:178-179
Behaviors behind the backdoor verdict
Observables
- Network Endpoint
- Payload withheldThe brute-force script contacts this Dahua P2P server to resolve device serial numbers and probe device status, which is expected behavior for a tool testing the vendor's infrastructure.
dahua-sn-brute2.py:25-26 - Credential
- Payload withheldHardcoded authentication token used to authenticate with the Dahua P2P server. This appears to be a shared or example credential for the research tool, not a stolen user credential.
dahua-sn-brute2.py:28 - Credential
- Payload withheldHardcoded key used in the WSSE authentication digest for the Dahua P2P server. Consistent with the research tool's authentication mechanism.
dahua-sn-brute2.py:29 - File Write
- Payload withheldThe brute-force script appends discovered valid serial numbers to a local file. This is expected output for a research tool and does not indicate unauthorized data exfiltration.
dahua-sn-brute2.py:178-179
What the analysis did not establish
- One file (total 5 files, 4 with text content) is omitted from the evidence packet; its content is unknown.
- The evidence packet reports complete_artifact_coverage is false, so the full repository content is not represented.
- The analysis is based solely on static code review; no dynamic execution or verification was performed.
- One text file (total 5 files) was omitted from the evidence packet; its content is unknown and could contain additional information.
- The analysis is limited to the supplied text content; no dynamic analysis or execution was performed.
- The hardcoded credentials in dahua-sn-brute2.py are not verified to be example/test credentials rather than leaked production secrets.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.