tc4dy/CVE-2026-60206-PoC-Exploit

GitHubRepository PoCExploit

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is an exploit framework for CVE-2026-60206, an Oracle WebLogic SAML authentication bypass. It contains Python and Bash scripts that craft and send malicious SAML assertions to gain administrative access, steal session cookies, and verify successful exploitation.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, a Python exploit script, a Bash exploit script, and a Bash verifier script, all targeting CVE-2026-60206 (Oracle WebLogic SAML authentication bypass). The code crafts and sends malicious SAML assertions to a target WebLogic server to achieve authentication bypass and session hijacking. No concealed backdoor, unrelated payload, credential exfiltration to an external party, or persistence mechanism was observed. The behavior is consistent with a proof-of-concept exploit for the stated vulnerability.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonBash
Target softwareOracle WebLogic Server
Attack typesauthentication bypassSAML injectionXML signature wrappingsession hijacking
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively constructs and delivers exploit payloads (malicious SAML assertions) to a target server to achieve authentication bypass and gain administrative access. It includes logic to verify successful exploitation by checking for admin console access. This is the primary stated purpose of the artifact, as described in the README and implemented in exploit.py and exploit.sh.

README.md:2exploit.py:463-484exploit.py:486-496

Requirements

  • Network access to a target Oracle WebLogic Server instance.exploit.py:336-337
  • Python 3.6+ with requests and urllib3, or Bash with curl.README.md:128-130

Observed behavior

  • Crafts and base64-encodes malicious SAML responses, including unsigned assertions, XML Signature Wrapping (XSW) variants, and NameID comment injection.exploit.py:181-309
  • Sends crafted SAMLResponse to discovered SAML ACS endpoints (e.g., /saml2/sp/acs) via HTTP POST.exploit.py:463-484
  • Checks for authentication success by inspecting response for JSESSIONID cookies, redirects to console, or presence of admin dashboard indicators.exploit.py:438-461
  • Verifies obtained administrative access by accessing the WebLogic console with the stolen JSESSIONID cookie.exploit.py:486-496
  • Supports mass scanning of multiple targets with threading, output to JSON/CSV/JSONL, and optional Shodan integration.exploit.py:498-507
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Crafts and sends malicious SAML assertions (unsigned, XSW, NameID injection) to /saml2/sp/acs and similar endpoints to bypass authentication.This is the core exploit behavior for CVE-2026-60206. It is not a backdoor.exploit.py:179-230exploit.py:463-484exploit.sh:183-239exploit.sh:537-625
Exploit Behavior
Steals JSESSIONID cookie from HTTP response and verifies admin access to /console/login/LoginForm.jsp.This is session hijacking, a direct consequence of the authentication bypass exploit. It does not exfiltrate the cookie to an external server.exploit.py:392-401exploit.py:438-461exploit.py:486-496exploit.sh:375-406exploit.sh:627-652
Exploit Behavior
Saves successful session cookie to a local file (e.g., session_<target>.txt).The cookie is saved locally for later use by the operator. This is not exfiltration.exploit.py:109-115exploit.py:621-622exploit.sh:167-172exploit.sh:743
Network Behavior
Sends HTTP requests only to the user-supplied target URL. No connections to hardcoded external IPs or domains.All network activity is directed at the target specified by the operator. There is no phone-home or C2 communication.exploit.py:336-390exploit.sh:408-454
File Operation
Writes scan results to a user-specified output file (.json, .csv, .jsonl) and a local scan.log.These are expected logging and output operations for a security tool. No system file modification or persistence is performed.exploit.py:510-527exploit.py:688-710
Review boundaries

What the analysis did not establish

  • Evidence includes only selected text files (README.md, exploit.py, exploit.sh, verifier_poc.sh). Three additional text files and one non-text file (60206.png) are present in the repository but not included in the analysis.
  • The artifact's code was not executed; classification is based solely on static analysis of the provided source code.
  • The evidence packet includes 4 text files out of 8 total files in the repository. The remaining 4 files (1 non-text media file and 3 unclassified files) were not provided and were not analyzed. Their content is unknown.
  • Binary files were flagged as metadata-only and not analyzed. The non-text media file (60206.png) could contain steganographic data, but this is speculative and not supported by the provided evidence.
  • The review is limited to static analysis of the provided source code. No dynamic execution or network traffic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1