Dhananjayasj/RRAS-VULNERABILITY-CVE-2026-25172-CVE-2026-25173-CVE-2026--26111

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a lab guide and a Python script to simulate a malicious RRAS server. The script listens on port 445 and sends a crafted payload intended to trigger an integer overflow, but it does not contain a working exploit; it only sends a static payload and instructs the user to check for a crash, functioning as a vulnerability scanner/detector.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README with lab setup instructions and a Python script (rras_exploit.py) that simulates a malicious RRAS server to trigger an integer overflow. The script listens on port 445, crafts a payload with a max DWORD and padding, and sends it to connecting clients. No backdoor, credential theft, persistence, or unrelated payload is present. The behavior is consistent with the stated educational purpose of demonstrating the CVE.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPythonMarkdown
Target softwareWindows Routing and Remote Access Service (RRAS)
Attack typesdenial of serviceremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script sends a crafted payload to trigger a vulnerability but does not achieve code execution or demonstrate a working exploit. It relies on manual observation of a crash, which is characteristic of a scanner/detector rather than an exploit.

rras_exploit.py:7-13rras_exploit.py:30

Requirements

  • An authenticated domain user or administrator must connect the RRAS management console to the attacker's server.README.md:8
  • Victim machine must be an unpatched Windows 11 build lower than 26100.7982 or 26200.7982.README.md:18

Observed behavior

  • Starts a TCP server on port 445 and sends a static payload consisting of a header, a max DWORD value (0xFFFFFFFF), and 1024 bytes of padding.rras_exploit.py:4-13rras_exploit.py:15-31
  • Instructs the user to check the victim machine for a crash or unexpected behavior after sending the payload.rras_exploit.py:30
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Listener
0.0.0.0:445The script binds to all interfaces on port 445 to accept connections and send a crafted payload, simulating a malicious server for the described vulnerability.rras_exploit.py:4-5rras_exploit.py:19
Crafted Payload
header + struct.pack('<I', 0xFFFFFFFF) + b'\x41' * 1024The payload is designed to trigger an integer overflow in the RRAS management tool, matching the described CVE exploitation scenario.rras_exploit.py:9-12
Review boundaries

What the analysis did not establish

  • The script uses a hardcoded payload and does not adapt to target versions or implement a full exploit chain.
  • The README describes a lab setup but does not provide a complete, automated exploit; it requires manual steps and observation.
  • Only the two text files (README.md and rras_exploit.py) were provided and reviewed; no other files from the repository were inspected.
  • Binary content was not present in the evidence, so no binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2