bluedragonsecurity/CVE-2005-0575-knet-exploit

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2005-0575, a buffer overflow in KNet Web Server 1.04b. It sends a crafted HTTP GET request containing an egghunter, shellcode, and SEH overwrite to achieve remote code execution and spawn a bind shell on TCP/4444.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script for CVE-2005-0575 and a README. The script sends a buffer overflow payload to a hardcoded target (10.200.0.120:80) and then opens a telnet connection to the same host on port 4444. This is standard exploit behavior: triggering a vulnerability to obtain a bind shell. No concealed backdoor, credential theft, persistence, or unrelated payload is present. The README contains only a description and an image reference.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareStormy Studios Knet Web Server 1.04b
Attack typesbuffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script sends a malicious HTTP GET request containing shellcode and SEH overwrite to trigger a buffer overflow and spawn a bind shell, which is the definition of an exploit.

knet_exploit.py:2knet_exploit.py:84-98knet_exploit.py:104-106

Requirements

  • Target running KNet Web Server 1.04b on Windows XP SP3 x86README.md:3
  • Attacker must be able to connect to target on port 80knet_exploit.py:96

Observed behavior

  • Constructs a buffer containing NOP sled, shellcode, egghunter, and SEH overwrite addressesknet_exploit.py:72-78
  • Sends the buffer as part of an HTTP GET request to the target serverknet_exploit.py:84-98
  • After a 10-second sleep, opens a telnet connection to the target on port 4444, expecting a bind shellknet_exploit.py:104-106
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends buffer overflow payload to target 10.200.0.120:80 and connects via telnet to 10.200.0.120:4444This is the expected behavior of a proof-of-concept exploit for CVE-2005-0575, which describes a buffer overflow in Knet Web Server. The script triggers the vulnerability and then provides a shell to the attacker.knet_exploit.py:84-106
Shellcode
Bind shell shellcode on port 4444The shellcode variable contains a payload that opens a bind shell on TCP port 4444, as noted in the comment on line 5. This is consistent with the exploit's purpose.knet_exploit.py:5-60
Review boundaries

What the analysis did not establish

  • One non-text file (pawn.png) was not inspected; it is a screenshot referenced in README.md and unlikely to alter classification.
  • The exploit targets a specific Windows XP SP3 environment and may require adjustment per README.md line 3.
  • One non-text file (pawn.png) was not analyzed; it is a screenshot referenced in the README and is unlikely to contain executable backdoor behavior.
  • The shellcode is opaque binary data; its exact behavior is not independently verified beyond the author's comment, but it aligns with the stated exploit goal.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1