0xBlackash/CVE-2026-54121

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a PowerShell script that performs read-only checks to detect whether a system is potentially vulnerable to CVE-2026-54121. It inspects the OS type, AD CS role installation, and recent security update status, and outputs a summary. It does not contain any exploit code.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README.md and a PowerShell script (CVE-2026-54121-SafeCheck.ps1). The script performs only read-only system checks (OS info, AD CS role detection, hotfix enumeration, event log queries, and read-only certutil commands) and explicitly states it is non-exploitative. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence98%
AuthenticationUnknown
LanguagesPowerShell
Target softwareMicrosoft Active Directory Certificate Services
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script explicitly states it is a 'Complete Safe Checker' and 'Fully non-exploitative detection script' that 'Does NOT exploit anything'. Its operations are limited to reading system configuration, installed roles, and update history to determine vulnerability status, which is characteristic of a scanner.

CVE-2026-54121-SafeCheck.ps1:3CVE-2026-54121-SafeCheck.ps1:5CVE-2026-54121-SafeCheck.ps1:10

Requirements

  • PowerShell 5.1 or laterCVE-2026-54121-SafeCheck.ps1:13
  • Execution on a Windows systemCVE-2026-54121-SafeCheck.ps1:44-45

Observed behavior

  • Gathers system information (OS, version, domain, product type) via CIMCVE-2026-54121-SafeCheck.ps1:44-45
  • Checks if the AD CS Certificate Authority role is installed via Get-WindowsFeature or Get-ServiceCVE-2026-54121-SafeCheck.ps1:81-82CVE-2026-54121-SafeCheck.ps1:95-96
  • Lists hotfixes installed on or after July 1, 2026CVE-2026-54121-SafeCheck.ps1:115-117
  • Queries Windows Update event log for recent successful installationsCVE-2026-54121-SafeCheck.ps1:139-145
  • If AD CS is installed, retrieves read-only CA information and lists certificate templates using certutilCVE-2026-54121-SafeCheck.ps1:168CVE-2026-54121-SafeCheck.ps1:181
  • Outputs a final summary and recommendation based on the checksCVE-2026-54121-SafeCheck.ps1:193-206
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Script Behavior
Read-only system information gatheringThe script uses Get-CimInstance, Get-WindowsFeature, Get-HotFix, Get-WinEvent, and certutil -CAInfo/-CATemplates, all of which are read-only operations. No file writes, network connections, or process creation are performed.CVE-2026-54121-SafeCheck.ps1:44-45CVE-2026-54121-SafeCheck.ps1:81CVE-2026-54121-SafeCheck.ps1:115-117CVE-2026-54121-SafeCheck.ps1:139-145CVE-2026-54121-SafeCheck.ps1:168CVE-2026-54121-SafeCheck.ps1:181
Script Claim
Non-exploitative detection onlyThe script header and final summary explicitly state it performs only read-only checks and does not attempt exploitation or modification.CVE-2026-54121-SafeCheck.ps1:5-7CVE-2026-54121-SafeCheck.ps1:209-210
Review boundaries

What the analysis did not establish

  • The README.md describes the vulnerability and attack flow but does not contain executable code; it is a writeup. The classification is based on the primary artifact, the PowerShell script, which is a scanner.
  • Only the two text files (README.md and CVE-2026-54121-SafeCheck.ps1) were reviewed; no other files exist in the repository according to the evidence envelope.
  • The script's behavior depends on the PowerShell environment, but the code itself contains no backdoor logic.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1