nehkark/CVE-2025-10230

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that crafts and sends a NetBIOS Name Registration packet to a target Samba WINS server. The script is designed to inject a user-supplied NetBIOS name into the server's 'wins hook' shell command, demonstrating remote command execution for CVE-2025-10230.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script that constructs and sends a NetBIOS Name Registration packet to a target WINS server. The script takes user-supplied arguments (target IP, NetBIOS name, source IP) and sends them over UDP. It does not execute any shell commands, establish persistence, exfiltrate data, or contact any unrelated remote hosts. The behavior is consistent with a legitimate demonstration of the described CVE-2025-10230 vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareSamba
Attack typesOS command injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively sends a crafted network packet to trigger a command injection vulnerability on a remote server. The script's own output refers to the action as an 'exploit' and the README describes it as a 'Proof-of-Concept (PoC)' that 'demonstrates how specially crafted NetBIOS Name Registration packets can trigger arbitrary shell commands'. This is code intended to exercise a vulnerability, not merely detect it.

poc/cve-2025-10230.py:205-207README.md:10README.md:19

Requirements

  • Target Samba server must have 'wins support = yes' and a non-empty 'wins hook' parameter configured.README.md:14-15
  • Attacker must be able to send UDP packets to port 137 on the target.poc/cve-2025-10230.py:120-122

Observed behavior

  • Constructs a NetBIOS Name Registration packet with a user-provided name.poc/cve-2025-10230.py:48-99
  • Sends the crafted packet to the target WINS server on UDP port 137.poc/cve-2025-10230.py:102-132
  • The script's output messages describe the action as sending an 'exploit'.poc/cve-2025-10230.py:205-207
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
UDP to user-supplied target IP on port 137The script sends a crafted NetBIOS packet to the target specified by the user via the -t argument. This is the expected behavior for a PoC demonstrating the WINS hook vulnerability.poc/cve-2025-10230.py:120-122
User Input
Command-line arguments -t, -p, -n, -i, --typeThe script accepts user-provided target IP, port, NetBIOS name, source IP, and name type. These are used solely to construct the demonstration packet and are not used for any other purpose.poc/cve-2025-10230.py:147-177
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false; 3 files (7414 bytes) are unclassified and not included in the analysis.
  • The analysis is based solely on the provided text content; the code was not executed, and its effectiveness or safety is not verified.
  • Three files (evidence/logs.md, conf/smb.conf, and one other) were present in the repository but their content was not provided for review. The analysis is limited to the README.md and poc/cve-2025-10230.py files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1