D4RKMATT3R/KyoceraCredsDump

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2022-1026 to extract credentials (SMB, FTP, email) from Kyocera printer address books via unauthenticated SOAP requests. It supports scanning multiple targets (CIDR, ranges, lists) with concurrent workers and outputs extracted usernames and passwords.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (KyoceraCredsDump.py) and a README.md. The script implements a multi-target scanner for CVE-2022-1026, extracting credentials from Kyocera printer address books via unauthenticated SOAP requests. No backdoor, trojan, or deceptive behavior is observed. The code performs only the advertised credential extraction and reporting; it contains no persistence mechanisms, unrelated remote access, data exfiltration to third parties, or concealed payloads. All network activity is directed at user-supplied targets. The README provides usage instructions and credits, with no hidden instructions or malicious intent.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareKyocera Net ViewerKyocera multifunction printers
Attack typescredential extractioninformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted SOAP requests to vulnerable Kyocera printers to extract credentials from the address book without authentication, which constitutes exploitation of CVE-2022-1026. It does not merely detect the vulnerability; it retrieves sensitive data.

KyoceraCredsDump.py:1-6KyoceraCredsDump.py:241-296README.md:1-3

Requirements

  • Target must be a Kyocera printer with the vulnerable SOAP service running on the specified port (default 9091).KyoceraCredsDump.py:247KyoceraCredsDump.py:446-447
  • Network connectivity to the target on the specified port.KyoceraCredsDump.py:161-168

Observed behavior

  • Sends an unauthenticated SOAP request to create an address book enumeration on the target.KyoceraCredsDump.py:250-251KyoceraCredsDump.py:140
  • Retrieves the address book list using the enumeration ID and parses the XML response for credentials (username, password, host, protocol).KyoceraCredsDump.py:275-276KyoceraCredsDump.py:282KyoceraCredsDump.py:199-238
  • Outputs extracted credentials in a formatted table, including target IP, protocol, host, username, and password.KyoceraCredsDump.py:325-353KyoceraCredsDump.py:371-427
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
HTTPS POST to user-supplied target IP:port/ws/km-wsdl/setting/address_bookThe script sends SOAP requests only to the Kyocera service endpoint on targets specified by the user via command-line arguments. No other outbound connections are made.KyoceraCredsDump.py:247-251KyoceraCredsDump.py:275-276
Credential Handling
Extracted credentials are stored in memory and printed to stdout; no file write or network exfiltration to third partiesThe walk_for_creds function collects credentials into a list, which is then formatted and printed by print_summary. No code writes credentials to disk or sends them to any remote server other than the target printer.KyoceraCredsDump.py:199-238KyoceraCredsDump.py:325-427
Code Origin
Based on original Rapid7 exploit by Aaron Herndon; modified by d4rkm4tt3r for multi-target support and pretty outputThe script header and README clearly attribute the original work and describe the modifications. No obfuscation or hidden authorship is present.KyoceraCredsDump.py:8-12README.md:2-4
Review boundaries

What the analysis did not establish

  • Evidence is limited to the readable text of two files (KyoceraCredsDump.py and README.md) from the repository snapshot. No binary files or network captures are included. The analysis is based solely on static code review; the code was not executed.
  • Only the two text files (KyoceraCredsDump.py and README.md) were supplied; no other repository files were reviewed.
  • Binary content was flagged as metadata-only and not analyzed, but no binary files were identified in the artifact.
  • The review is based solely on static analysis of the provided source code; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1