CVE-2025-26244-POC

The code to exploit this vulnerability can be seen in 'spoof.go'. This imitates as an agent to the C2 server. In order to run this vulnerability we need to know:

1. The listener IP address and Port
2. The public key of the listener.
3. The first time check in URL of the listener.

We could obtain this information by reverse engineering a binary previously generated by the operator.

Currently, 'spoof.go' only works when both the listener and agent use the HTTPS protocol, however, if adapted this will likely work with the other protocols DeimosC2 supports.

To Exploit

1. You will need access to a HTTPS binary previously generated by the operator.

2. Extract the IP address, port, the public key and first time check in URL of the listener from the binary. Trend Micro provide scripts to aid in this.

3. Place the IP address, port, the public key and first time check in URL of the listener into the script.

4. Install the DeimosC2 Crypto Library

go install github.com/DeimosC2/DeimosC2/lib/crypto@latest

5. Run the script.

go run Spoof.go

6. A new agent will be registered and as soon as the operator loads the graph view the XSS will trigger and you will have their cookie!

If you only have access to a binary with one of the other protocols, spoof.go will need to be adapted to support the other protocols.