Smarttfoxx/CVE-2026-29923

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md file that describes a local privilege escalation vulnerability (CVE-2026-29923) in the pstrip64.sys driver. It provides a technical analysis of the IOCTL handler, explains how arbitrary physical memory mapping can be abused to overwrite kernel structures, and outlines exploitation steps, but explicitly states that no exploit code is provided.

Backdoor review

No backdoor observed in reviewed code

The artifact is a README.md file describing a known privilege escalation vulnerability (CVE-2026-29923) in the pstrip64.sys driver. The text explains the vulnerability mechanism (arbitrary physical memory mapping via IOCTL) and outlines a theoretical exploitation method (scanning physical memory, locating EPROCESS structures, and overwriting a token). No executable code, scripts, or instructions for the reader to execute are present. The author explicitly states that no PoC code is provided. The described behavior is consistent with the documented CVE and does not exhibit backdoor or deceptive payload characteristics.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesmarkdown
Target softwareEnTech Taiwan PowerStrip
Attack typesprivilege_escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a technical writeup. It contains a substantive analysis of the vulnerability, including vulnerable code logic and exploitation steps, but does not include any executable exploit or scanner code. The author explicitly states that no code is provided.

README.md:26

Requirements

  • Local, low-privileged access to a system with the vulnerable pstrip64.sys driver installed.README.md:2

Observed behavior

  • The document describes the vulnerability in the IOCTL handler 0x80002008, which maps arbitrary physical memory into the calling process's address space.README.md:6
  • The document outlines a proof-of-concept exploitation method that scans physical memory for _EPROCESS structures and overwrites a process token to gain SYSTEM privileges.README.md:26-30
  • The author explicitly states that no exploit code will be made publicly available.README.md:26
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
CVE-2026-29923: pstrip64.sys driver allows local privilege escalation via arbitrary physical memory mapping through IOCTL 0x80002008.The README documents a legitimate vulnerability, not a backdoor. The described exploitation technique (token stealing) is a standard privilege escalation method.README.md:1-8
Code Snippet
RtlInitUnicodeString(&DestinationString, L"\\Device\\PhysicalMemory"); ... ZwOpenSection ... ZwMapViewOfSectionSnippet illustrates the vulnerable driver logic. It is presented as documentation, not as executable instructions for the reader.README.md:11-17
Author Statement
A PoC was developed to demonstrate privilege escalation, however, no code will be made available publicly to avoid misuse.Confirms that no executable PoC is included in the repository, reducing the risk of hidden malicious payloads.README.md:26
Review boundaries

What the analysis did not establish

  • The evidence consists of a single README.md file; no source code, binary, or executable artifact is included.
  • The analysis is based solely on the text description and cannot verify the accuracy of the technical claims or the existence of the described vulnerability.
  • Only the README.md file was provided; no other repository files (e.g., source code, scripts, binaries) were included in the evidence packet.
  • The analysis scope confirms 'NO_POC_CODE_IDENTIFIED' and 'NO_EXECUTABLE_SOURCE_IDENTIFIED', so the review is limited to the documentation text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1