totekuh
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubtotekuh/CVE-2026-36356
Repository PoCStars: 0Created 2026-05-03ExploitCVE-2026-363565 files
Analysis
Technical assessment
The artifact contains a Python script (poc_rce.py) that sends a crafted HTTP POST request to the vulnerable /action/SetRemoteAccessCfg endpoint to execute arbitrary OS commands on a target device. The script constructs a JSON payload with a command injection in the 'password' field and sends it without authentication, exercising the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md vulnerability advisory and a poc_rce.py exploit script for CVE-2026-36356. The README describes an unauthenticated OS command injection in a GoAhead web server on a specific IoT device, and the Python script implements a proof-of-concept exploit that sends a crafted HTTP request to the vulnerable endpoint. The script's behavior is entirely consistent with the described vulnerability: it takes a user-supplied command, wraps it in a shell substitution, and sends it to the target. No concealed executable behavior, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the stated exploit is present. The code is straightforward and unobfuscated.
Classification basis and observed behavior
Classification basis
The file poc_rce.py is a functional script that actively exploits the CVE-2026-36356 vulnerability by sending a malicious HTTP request to execute arbitrary commands on a target system. It is not merely a scanner or a writeup; it is code intended to exercise the vulnerability.
poc_rce.py:1-76README.md:60-69Requirements
- Target device must be a MeiG Smart FORGE_SLT711 with vulnerable firmware (e.g., MDM9607.LE.1.0-00110-STD.PROD-1) running the GoAhead web server.
README.md:10README.md:18 - Network access to the target device's HTTP service (default port 80).
poc_rce.py:30
Observed behavior
- Sends an unauthenticated HTTP POST request to /action/SetRemoteAccessCfg with a JSON body containing a command injection payload in the 'password' field.
poc_rce.py:30-38 - Checks the HTTP response for a 'retcode' of 0 to confirm command execution.
poc_rce.py:40-46
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldThis is the intended PoC behavior for CVE-2026-36356, not a backdoor.
poc_rce.py:31poc_rce.py:64 - Network Connection
- Payload withheldThis is the delivery mechanism for the exploit, not a backdoor.
poc_rce.py:30poc_rce.py:33-38
What the analysis did not establish
- The evidence packet does not include the binary firmware or the GoAhead binary; the decompiled handler code is only described in the README.
- The packet indicates complete_artifact_coverage is false, and two text files are omitted from the content, though the primary exploit code and README are fully included.
- One non-text media file (rce-demo.png) was present in the repository but not analyzed; it is a screenshot referenced in the README.
- Two additional text files (route.txt and a firmware binary) were present in the repository but their content was not included in the evidence packet; they are described in the README as supporting the vulnerability analysis.
- The review is limited to the supplied evidence and does not assess the safety of executing the PoC against a real device.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubtotekuh/CVE-2026-36355
Repository PoCStars: 0Created 2026-05-03ExploitCVE-2026-363555 files
Analysis
Technical assessment
The artifact contains a complete, portable local privilege escalation exploit (kpwn.c) for CVE-2026-36355. It uses the vulnerable write_mem/read_mem ioctls in the Realtek rtl819x driver to read and write arbitrary kernel memory, auto-detects task_struct offsets, and overwrites process credentials to gain root from an unprivileged user.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README.md describing CVE-2026-36355 and a reference exploit (kpwn.c) that demonstrates local privilege escalation by abusing missing access-control checks on debug ioctls in the Realtek rtl819x Jungle SDK Wi-Fi driver. The exploit code performs only the actions necessary to achieve privilege escalation: finding a vulnerable interface, reading/writing kernel memory to locate and overwrite the calling process's credentials, and spawning a root shell. No concealed executable behavior, unrelated payload delivery, persistence mechanisms, or operator-directed harm were observed. The code is straightforward C with no obfuscation or hidden functionality.
Classification basis and observed behavior
Classification basis
The primary artifact is kpwn.c, a complete C program that actively exploits CVE-2026-36355 to achieve local privilege escalation. It uses the vulnerable ioctls to read and write kernel memory, locates and modifies its own process credentials, and executes a root shell. This is code intended to exercise a vulnerability, not merely detect or document it.
kpwn.c:1-14kpwn.c:330-423Requirements
- Local unprivileged user access to a device with a vulnerable Realtek rtl819x Wi-Fi driver loaded and a wireless interface available.
kpwn.c:16 - Ability to open a socket and perform ioctl calls on the wireless interface (may require membership in the 'inet' group on some kernels).
kpwn.c:341-347
Observed behavior
- Scans /sys/class/net to find a wireless interface that responds to the read_mem ioctl (0x89F6) with valid data.
kpwn.c:100-119 - Brute-force scans kernel .data memory region to locate the init_task structure by searching for the 'swapper' string and validating the associated credential structure.
kpwn.c:123-178 - Auto-detects task_struct field offsets (comm, cred, tasks, pid) by analyzing the memory layout of init_task.
kpwn.c:189-278 - Walks the kernel task list to find the task_struct of the current process.
kpwn.c:282-326 - Uses the write_mem ioctl (0x89F5) to overwrite the process's kernel credentials (UID, GID, capability sets) with root-equivalent values.
kpwn.c:406-409 - Spawns a root shell via execl('/bin/sh', 'sh', NULL) after successful credential overwrite.
kpwn.c:420
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe exploit leverages the documented vulnerability to overwrite process credentials and gain root. This is the expected and stated purpose of the PoC.
kpwn.c:406-410kpwn.c:420 - Ioctl Usage
- Payload withheldThese ioctl codes correspond to the vulnerable write_mem and read_mem handlers described in the CVE. The exploit uses them exclusively for kernel memory access.
kpwn.c:36-37kpwn.c:49-96 - Credential Overwrite
- Payload withheldThis is the standard technique for privilege escalation via credential structure overwrite. It targets only the calling process's own credentials.
kpwn.c:408-409
What the analysis did not establish
- The evidence packet includes only the README.md and kpwn.c files. Two other text files and one non-text file (likely the screenshot kpwn-demo.png) are present in the repository but their content is not provided.
- The analysis is based solely on static review of the provided source code; the exploit was not executed or tested.
- Three additional files in the repository (totaling 5 files) were not included as text in the evidence packet. Their content is unknown, but the packet metadata indicates they are non-text or were omitted by the selection rule. The review is limited to the provided README.md and kpwn.c.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.