w116tjb/plex2shell-windows-huntPlex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script
Threat intel and a read-only Windows/Linux compromise check for Plex2Shell: CVE-2026-96652, -96654, -96655 and -96656. These four bugs chain into unauthenticated RCE in Plex Media Server versions before 1.43.3.10861.
| File | What it is |
|---|---|
Plex2Shell_IOC_IOA_Dossier.md | IOCs, IOAs, the exploit chain, Windows artifacts, and criteria for judging whether a checker script is legitimate |
Invoke-Plex2ShellHunt.patched.ps1 | Read-only hunt script (Windows PowerShell 5.1 / PowerShell 7+) |
reference/ | Third-party detection content (see below) |
Run it from an elevated PowerShell prompt on the Plex host:
.\Invoke-Plex2ShellHunt.patched.ps1 -LookbackDays 90 -CollectEvidence
The script only reads the system. It writes nothing outside its own report folder (%TEMP%\Plex2ShellHunt_<host>_<timestamp>) and makes no network calls.
| Exit code | Meaning |
|---|---|
| 0 | Clean |
| 1 | Vulnerable version only |
| 2 | Suspicious |
| 3 | Likely exploited |
| 4 | Compromised |
The original script has SHA-256 a200a00545aa85e3d35563e0e099fec5e942ae9d346392efc01abaebd52c5871.
rundll32 …\Codecs\…dll,RunShell payload host after Plex Transcoder.exe has exited. It also checks every process for loaded Codecs DLLs and flags external connections from those processes.dump-yuv, whatever padding byte was used: an unmapped PE or ELF overlay, a near-uniform tail, and a repeated frame.hevc_decoder.dll is a genuine codec that the PoC overwrites in place, so the name alone is reported as Info only.$null .Modules list no longer raises an error.Field-tested 2026-10-21 on PMS 1.43.5.11029 (Windows 11, PowerShell 5.1). The result was clean, with no errors and no false positives.
The files in reference/ (plex2shell.yar, plex2shell-hunt.sh, pms_malicious_sample.log) are copied unmodified from code-zm/plex2shell at commit 24e07c02. © the plex2shell authors, licensed GPLv3: see reference/LICENSE-plex2shell-GPLv3.