CVE-2026-33824

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a C++ exploit for CVE-2026-33824, a double-free vulnerability in the Windows IKE Extension. It sends crafted IKE packets over UDP to trigger the vulnerability, uses heap grooming and ROP chains to achieve code execution, and deploys a reverse shell listener.

Backdoor review

Suspicious behavior

The PoC for CVE-2026-33824 contains a concealed, non-disclosed command that disables Windows Defender via PowerShell, executed locally on the operator's machine. This behavior is materially misrepresented as it is not part of the disclosed IKE exploit and is hidden within the code without documentation.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC++
Target softwareWindows Internet Key Exchange (IKE) Service Extensions
Attack typesremote code executiondouble freeROP chain
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code is designed to actively exploit a vulnerability. It includes functions to trigger a double-free (trigger_double_free), build a ROP chain (init_rop_module), and deploy a reverse shell (start_shell_listener), which are hallmarks of an exploit.

EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:9545EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:8414EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:11185

Requirements

  • Target IP address and port must be provided as command-line arguments.EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:2347
  • The target must be running a vulnerable version of the Windows IKE service.EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:1

Observed behavior

  • Sends crafted IKE packets to a target to trigger a double-free vulnerability.EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:8467
  • Constructs and deploys a ROP chain to execute shellcode.EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:8414
  • Starts a reverse shell listener to receive a connection from the compromised target.EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:11185
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Local Payload
  • The code executes a hidden PowerShell command to disable Windows Defender real-time monitoring, behavior monitoring, IOAV protection, script scanning, and on-access protection on the operator's machine. This is unrelated to the disclosed IKE double-free exploit and is not documented in the PoC's purpose.EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:10557

Observables

Command Execution
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableOnAccessProtection $true -Force"This command is executed via CreateProcessA on the operator's machine, disabling multiple Windows Defender protection features without the operator's knowledge or consent.EpSiLoNPoInTOrI-IKEV2-POC-0b90679/EpSiLoNPoInTIkEv2.cpp:10557-10558
Review boundaries

What the analysis did not establish

  • Evidence is a bounded excerpt of a single large C++ file; the full artifact is not available, so analysis is based on the provided excerpts.
  • The evidence is excerpted and does not include the full function context or call chain for the PowerShell command execution, so it is not possible to determine if this code path is always reached or under what conditions it is triggered.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1