From 28df627c394e10a65844d0757889b7e5aacf1fca Mon Sep 17 00:00:00 2001 From: Church of Malware <3+ek0ms@noreply.git.churchofmalware.org> Date: Mon, 29 Jun 2026 16:28:37 +0000 Subject: [PATCH] Upload files to "/" --- README.md | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++-- cves.md | 15 ++++++++++ 2 files changed, 96 insertions(+), 2 deletions(-) create mode 100644 cves.md diff --git a/README.md b/README.md index 2b64124..a1b6774 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,82 @@ -# EXPLOITARIUM +https://discord.gg/WytKH65ZR join up for research, help, documentation, and more useful information for those interested. + +# Statement + +This repo was incomplete when published. That's why some findings are kinda ass (ghidra) and some are better. Going forward, only serious vulnerabilities will be shared (Floci, libssh2, FFmpeg, c-ares). + +In regard to AI usage, my fuzzing workflow was automated by AI with a strict harness. I used GPT-5.5-3-Codex-Spark for ALL the fuzzing, as barely any "thought" is necessary when provided with an efficient harness. Contrary to the growing narrative that I'm just some random child burning tokens, I DO actually have a degree in the subject and have published multiple papers on fuzzing methodology. I spent years researching and developing new tools and ideas for how to fuzz. You do NOT need a SOTA model to help you identify these issues, I promise! While being able to afford a better model is helpful, my data seems to show that it is only marginal when paired with decent human oversight and a good harness. None of the actual PoCs themselves were vibe-coded; I did, in fact, hand-type them. I did use AI assistance for RustDesk, however, as I'm not as familiar with the language. The README files are very clearly entirely AI, however, as AI can format a pretty mean Markdown file. I reviewed them to make sure they were accurate. + +I'd also like to credit someone for the objdump finding. It turns out, someone beat me to the punch (they also have a better PoC too!). Please give them the credit they deserve: +https://github.com/4D4J/objdump-Out-Of-Bounds-write + +# News/Contact + +New drops today ;) Biggest thing yet (DELAYED, I PROMISE THE WAIT WILL BE WORTH IT! After this, you guys will *usually* get one new PoC a day) + +I've also noticed a surprising amount of "security researchers" aren't able to adjust the PoC to work in their environment. I will broaden the PoCs for those select few... + +If you wish to collaborate/discuss with me, contact me on discord @ashdfrkl + +Sharing this repo keeps me motivated to continue dropping my findings for you all. + + +# Exploitarium + +A consolidated archive of my public proof-of-concept and vulnerability research writeups. + +Most folders contain one of my former standalone PoC repos, preserved with its original README and tracked files. New research entries are added directly here as self-contained folders. + +## Contents + +| Folder | Source | Tracked entries | +| --- | --- | ---: | +| `7zip-rar5-motw-chain-poc` | `bd9533f532c1e4ee6af783b9bb49d1133c600e2c` | 3 | +| `anydesk-printer-com-impersonation-poc` | `7491303301093b2d40bee9dadf6b38f757ce78e0` | 4 | +| `c-ares-tcp-uaf-calc-poc` | direct entry, June 24, 2026 | 7 | +| `docker-cp-copyout-destination-escape` | `d1367b1381736d7f961ac808ce88d4e24a633adc` | 5 | +| `firefox-smartwindow-private-url-exfil-poc` | direct entry, June 24, 2026 | 3 | +| `floci-apigateway-vtl-rce-poc` | direct entry, June 23, 2026 | 3 | +| `flowise-mcp-env-case-bypass-poc` | `ed9fab0086674f1b16467990b33bb9299e93429e` | 3 | +| `ffmpeg-rasc-dlta-calc-poc` | direct entry, June 26, 2026 | 7 | +| `ghidra-12.1.2-rce-ace-calc-poc` | `52dee6362990c03c0d753d074c85428824d46368` | 9 | +| `gitea-act-runner-container-options-poc` | `f06d78fb111732f3e7737f4c07e77ef94c4b64bf` | 4 | +| `imagemagick-gs-delegate-hijack-poc` | `8140e8ee0ed78beaf5e8303a795b70b138f5891b` | 5 | +| `libssh2-cve-2026-55200-poc` | direct entry, June 23, 2026 | 3 | +| `libssh2-publickey-list-calc-poc` | direct entry, June 25, 2026 | 10 | +| `lunar-modrinth-chain-poc` | `ffd02120708b6503f11585858ce3724872f3b7a7` | 6 | +| `mybb-limited-acp-to-admin` | `1610e0373943c2f6562a99f917d3a3d1fdd9056d` | 5 | +| `nghttp2-nghttpx-upgrade-queue-poison-poc` | direct entry, June 26, 2026 | 3 | +| `nmap-ipv6-extlen-wrap-poc` | direct entry, June 23, 2026 | 4 | +| `objdump-dlx-calc-poc` | `7df01e4e20c7375a89e8ccf760526c52eb6ad582` | 41 | +| `openvpn-connect-echo-script-ace-poc` | `d2f904d9272d4388c9862131d40e32e072e85e38` | 8 | +| `php857-streambucket-soap-rce-rpoc` | direct entry, June 26, 2026 | 6 | +| `rustdesk-session-permission-pocs` | direct entry, June 25, 2026 | 17 | +| `systeminformer-phsvc-trusted-host-lpe-poc` | direct entry, June 24, 2026 | 3 | +| `vlc-vp9-reschange-crash-poc` | `fae72b82f24d03cf2fb9cb55fbb2e7774f684ff3` | 3 | + +## Consolidation Check + +This section applies to the former standalone repositories listed above by commit hash. + +The consolidation was checked from fresh GitHub clones on June 23, 2026 before the old standalone repos were removed. + +The check compared each former standalone repo's `HEAD` tree against the matching folder here using Git tree data rather than a loose filesystem diff. For every tracked entry, the check required: + +- the same relative path; +- the same Git object type; +- the same tree mode, including executable bits; +- the same Git blob ID. + +Matching Git blob IDs means the tracked file bytes are identical. The check covered 12 repos and 96 tracked entries with zero mismatches. + +This repository preserves the contents of those PoCs. Repository-level metadata such as stars, issues, pull requests, releases, and separate Git history remain in the original repository histories. + +Direct entries, including `c-ares-tcp-uaf-calc-poc`, `ffmpeg-rasc-dlta-calc-poc`, `firefox-smartwindow-private-url-exfil-poc`, `floci-apigateway-vtl-rce-poc`, `libssh2-cve-2026-55200-poc`, `libssh2-publickey-list-calc-poc`, `nghttp2-nghttpx-upgrade-queue-poison-poc`, `nmap-ipv6-extlen-wrap-poc`, `php857-streambucket-soap-rce-rpoc`, `rustdesk-session-permission-pocs`, and `systeminformer-phsvc-trusted-host-lpe-poc`, are tracked by this repository's commit history. + +## ABUSE + +Do NOT, under any circumstances, use any material in this repository maliciously. This is good-faith, open-disclosure vulnerability research intended to get more people interested in exploring this area of cybersecurity. + +Cybercrime is cringe. + -bikini exploit repo \ No newline at end of file diff --git a/cves.md b/cves.md new file mode 100644 index 0000000..c95f5b5 --- /dev/null +++ b/cves.md @@ -0,0 +1,15 @@ +# CVE'S GIVEN SO FAR BASED ON THE RESEARCH IN THIS REPOSITORY + +```CVE-2026-58052 +CVE-2026-58051 +CVE-2026-58050 +CVE-2026-58049 +CVE-2026-58058 +CVE-2026-58056 +CVE-2026-58055 +CVE-2026-58054 +CVE-2026-58057 +CVE-2026-58053 +``` + +# Thank you all for your support!