zenzue
Source-scoped identity with 7 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 7 PoCs on this page
GitHubzenzue/CVE_2026_31694
Repository PoCStars: 0Created 2026-07-29ScannerUnlinked2 files
Analysis
Technical assessment
The artifact is a passive vulnerability scanner for CVE-2026-31694. It reads local system metadata, kernel configuration, and package information to assess exposure without triggering the vulnerable code path.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python scanner script for CVE-2026-31694. The scanner performs only passive, read-only system inspection (kernel config, /proc, package queries) and generates a report. It does not execute any payload, establish persistence, exfiltrate data, or perform any action beyond the documented vulnerability assessment. No concealed, deceptive, or operator-directed harmful behavior is present.
Classification basis and observed behavior
Classification basis
The artifact is a scanner because it only checks for vulnerability exposure by reading local system metadata and configuration without exploiting the vulnerability. The README explicitly states it is a 'passive, non-exploit vulnerability assessment utility' and the code does not mount FUSE filesystems, send crafted replies, or trigger the vulnerable code path.
README.md:39README.md:41cve_2026_31694_scanner.py:6-11Requirements
- Linux operating system
cve_2026_31694_scanner.py:489 - Python 3.9 or newer
README.md:188 - Read access to system metadata files (e.g., /proc, /boot, /lib/modules)
README.md:189
Observed behavior
- Reads kernel release and parses version
cve_2026_31694_scanner.py:482-483 - Reads kernel configuration from /proc/config.gz, /boot/config-*, or /lib/modules/*/build/.config
cve_2026_31694_scanner.py:222-235 - Checks for registered FUSE filesystem types in /proc/filesystems
cve_2026_31694_scanner.py:252-267 - Checks /dev/fuse presence and permissions
cve_2026_31694_scanner.py:270-288 - Searches for FUSE mount helper (fusermount3/fusermount) in PATH
cve_2026_31694_scanner.py:553 - Parses /proc/self/mountinfo for active FUSE mounts
cve_2026_31694_scanner.py:291-309 - Searches installed kernel source for patch guard (reclen > PAGE_SIZE)
cve_2026_31694_scanner.py:339-356 - Queries package manager (dpkg, rpm, pacman) to identify kernel package
cve_2026_31694_scanner.py:359-388 - Searches local package changelogs for CVE ID or patch title
cve_2026_31694_scanner.py:391-440 - Compares parsed kernel version against upstream fixed baselines
cve_2026_31694_scanner.py:135-181 - Generates a verdict (PATCHED, NOT_EXPOSED, POTENTIALLY_VULNERABLE, etc.) and prints a report
cve_2026_31694_scanner.py:639-710
Behaviors behind the backdoor verdict
Observables
- Script Behavior
- Payload withheldThe script reads local files (/proc, /boot, /etc/os-release, etc.) and runs bounded, read-only package queries (dpkg-query, rpm, pacman) to assess CVE-2026-31694 exposure. It does not modify the system, execute payloads, or establish remote access.
cve_2026_31694_scanner.py:87-114cve_2026_31694_scanner.py:480-710 - Author Contact
- Payload withheldAuthor name listed in README and script header. This is standard attribution and does not indicate malicious intent.
README.md:7README.md:1263-1265
What the analysis did not establish
- complete_artifact_coverage is false; only two text files are included, but the repository may contain additional files not analyzed.
- The review is based solely on the supplied text files (README.md and cve_2026_31694_scanner.py). No binary files or other repository content were inspected.
- The scanner executes external commands (dpkg-query, rpm, pacman, etc.) via subprocess.run with bounded output; while these are read-only queries in the reviewed code, the review cannot guarantee that the external binaries themselves are uncompromised on a target system.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubzenzue/CVE-2026-31431-Checker-Mitigator
Repository PoCStars: 1Created 2026-05-06ExploitCVE-2026-314314 files
Analysis
Technical assessment
The artifact is a Python script (cve-2026-31431-checker.py) that includes a full exploit payload and execution logic for CVE-2026-31431, a Linux kernel local privilege escalation vulnerability. It also contains a separate scanner script and a mitigation script, but the primary artifact bundles an interactive menu that offers to run the exploit.
Backdoor review
No backdoor observed in reviewed code
The repository contains a CVE-2026-31431 checker/mitigator with a PoC exploit. The PoC payload is a compressed, hex-encoded binary blob that is decompressed and used to corrupt the page cache of /usr/bin/su via AF_ALG socket operations. This behavior is consistent with the described vulnerability exploitation and does not exhibit concealed operator-directed harm such as credential theft, unrelated remote access, or persistence. No backdoor or deceptive payload targeting the person running the PoC was observed.
Classification basis and observed behavior
Classification basis
The main script cve-2026-31431-checker.py contains a complete, executable exploit function (run_poc) that corrupts the page cache of /usr/bin/su using AF_ALG and splice, then attempts to gain a root shell. The README explicitly labels this as a PoC and warns it is dangerous. Although the artifact also includes scanner and mitigation components, the presence of a functional exploit payload and execution logic makes the primary classification 'exploit'.
cve-2026-31431-checker.py:48-64README.md:17README.md:45Requirements
- Local unprivileged user access to a Linux system with AF_ALG sockets and algif_aead module available.
cve-2026-31431-checker.py:48-49cve-2026-31431-checker.py:71-77 - Target setuid binary /usr/bin/su must exist and be readable.
cve-2026-31431-checker.py:51
Observed behavior
- Checks if AF_ALG sockets are available to determine vulnerability.
cve-2026-31431-checker.py:71-77 - Opens /usr/bin/su for reading and decompresses a hardcoded exploit payload.
cve-2026-31431-checker.py:51-52 - Iterates over the payload, calling exploit_step to corrupt the page cache of /usr/bin/su via AF_ALG socket operations and splice.
cve-2026-31431-checker.py:55-56cve-2026-31431-checker.py:15-46 - Attempts to spawn a root shell by executing the corrupted /usr/bin/su.
cve-2026-31431-checker.py:60 - Offers a mitigation option that blacklists and unloads the algif_aead kernel module.
cve-2026-31431-checker.py:82-92
Behaviors behind the backdoor verdict
Observables
- Compressed Payload
- Payload withheldHex-encoded zlib-compressed payload used in the PoC to corrupt /usr/bin/su page cache. The payload is opaque but its use is consistent with the stated exploit behavior.
cve-2026-31431-checker.py:10 - Exploit Behavior
- Payload withheldThe run_poc() function opens /usr/bin/su, decompresses the payload, and calls exploit_step() to corrupt the file's page cache. This matches the described CVE-2026-31431 exploitation technique.
cve-2026-31431-checker.py:48-64
What the analysis did not establish
- The exploit payload is compressed and opaque; its exact content and behavior cannot be fully verified from the provided text alone.
- The evidence does not confirm whether the exploit code is functional or reliable in practice.
- The compressed payload (PAYLOAD_COMPRESSED) is opaque binary data; its exact contents were not decompiled or analyzed beyond its use in the exploit function.
- Only the selected commit snapshot was reviewed; other branches or historical commits were not examined.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubzenzue/CVE-2025-9074
Repository PoCStars: 10Created 2025-08-25ExploitCVE-2025-90743 files
Analysis
Technical assessment
A Python script that exploits CVE-2025-9074 by connecting to the unauthenticated Docker Engine API from within a container, creating a new container with a bind mount to the Windows host drive, and writing a file to C:\.
Backdoor review
No backdoor observed in reviewed code
The PoC code and README demonstrate the claimed CVE-2025-9074 exploit behavior: connecting to the Docker Engine API and creating a container with a bind mount to write a file on the host. No concealed, deceptive, or unrelated harmful behavior was observed in the supplied text.
Classification basis and observed behavior
Classification basis
The artifact contains executable Python code that actively exploits the vulnerability by using the Docker Engine API to create and start a container with a host bind mount, resulting in a file write to the host filesystem. This goes beyond detection or scanning and constitutes an exploit.
cve_2025_9074_poc.py:38-62README.md:15-17Requirements
- Execution from inside a container on a vulnerable Docker Desktop for Windows host where the Docker Engine API is reachable at 192.168.65.7:2375 without authentication.
README.md:9README.md:23-25cve_2025_9074_poc.py:3
Observed behavior
- Sends an HTTP GET request to /_ping on the Docker Engine API to verify connectivity.
cve_2025_9074_poc.py:28-29 - Creates a new container via the Docker Engine API with a bind mount from the host path /mnt/host/c to /host_root inside the container.
cve_2025_9074_poc.py:38-44 - Starts the created container, which executes a shell command to write 'pwned_by_CVE_2025_9074' to a file on the mounted host drive (payload withheld).
cve_2025_9074_poc.py:60-62cve_2025_9074_poc.py:84
Behaviors behind the backdoor verdict
Observables
- Network Endpoint
- Payload withheldDefault Docker Engine API target used by the PoC to exploit CVE-2025-9074.
cve_2025_9074_poc.py:66-67cve_2025_9074_poc.py:76 - File Write
- Payload withheldFile created on the Windows host as proof of successful exploitation.
cve_2025_9074_poc.py:84cve_2025_9074_poc.py:89 - Container Creation
- Payload withheldExploit mechanism to gain write access to the host filesystem from within a container.
cve_2025_9074_poc.py:38-45cve_2025_9074_poc.py:69-72
What the analysis did not establish
- One file (LICENSE) is omitted from the text evidence; its content is not inspected but is unlikely to alter the classification.
- The evidence does not include execution output or confirmation that the exploit was successfully run.
- One file (LICENSE) was omitted from the text evidence; its content was not reviewed.
- The review is based solely on static source code and documentation; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubzenzue/CVE-2025-50154
Repository PoCStars: 3Created 2025-08-13ScannerCVE-2025-501543 files
Analysis
Technical assessment
The artifact is a defensive toolkit and detection rule set for auditing, hardening, and hunting NTLM/SMB usage related to CVE-2025-50154. It includes a PowerShell script for configuration checks and hardening, and Sigma rules for detecting suspicious Explorer-initiated SMB connections. It does not contain exploit code.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README and a Sigma detection rule file. The README describes a defensive NTLM/SMB hardening and threat hunting toolkit, and the Sigma file provides detection rules for suspicious NTLM/SMB activity. No executable code, obfuscated payloads, or instructions to run untrusted binaries are present. The content is purely informational and defensive in nature.
Classification basis and observed behavior
Classification basis
The artifact's primary purpose is to detect and audit for the vulnerability, not to exploit it. The README describes a toolkit for auditing, hardening, and hunting, and the Sigma rules are detection signatures. No code is present that exercises the vulnerability to gain unauthorized access or leak credentials.
README.md:5README.md:27-41sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:1-4Requirements
- The PowerShell script requires execution on a Windows host with appropriate permissions to read and modify registry, service, and firewall configurations.
README.md:28-30 - The Sigma rules require a SIEM or log analysis platform with ingested Windows Event Logs (Security, Sysmon) or Windows Filtering Platform events.
sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:13-16
Observed behavior
- The PowerShell script audits current registry, service, and firewall configurations and outputs pass/fail results with recommended fixes.
README.md:27-28 - The PowerShell script applies security hardening settings such as NTLM restrictions, SMB signing, and disabling SMBv1.
README.md:29-30 - The PowerShell script performs event hunting by gathering NTLM operational logs, security logon events, and Sysmon network connection events.
README.md:33-38 - The Sigma rules detect Explorer.exe initiating SMB connections to untrusted networks, LNK file creation on desktops, and NTLM network logons to untrusted addresses.
sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:1-4sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:60-63sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:90-93
Behaviors behind the backdoor verdict
Observables
- File
- Payload withheldDescribes a defensive toolkit for auditing and hardening NTLM/SMB configurations, with no executable payload.
README.md:1-135 - File
- Payload withheldContains Sigma detection rules for identifying suspicious NTLM/SMB activity, with no executable payload.
sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:1-251
What the analysis did not establish
- The PowerShell script content is not included in the evidence; only its description in the README is available.
- The evidence includes only two of three total files; one file is omitted.
- The artifact's complete_artifact_coverage is false, indicating not all files were analyzed.
- One file (unclassified, 16285 bytes) was not provided as text and was not analyzed; its content is unknown.
- The analysis is limited to the supplied text evidence and does not include execution or dynamic analysis.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.