Exploit proof-of-concepts (PoCs) for known vulnerabilities are widely shared in the security community. They help security analysts to learn from each other and they facilitate security assessments and red teaming tasks. In the recent years, PoCs have been widely distributed, e.g., via dedicated websites and platforms, and public code repositories such as GitHub. However, there is no guarantee that PoCs in public code repositories come from trustworthy sources or even that they do what they are supposed to do. In this work we investigate GitHub-hosted PoCs for known vulnerabilities discovered in 2017--2021. We discovered that not all PoCs are trustworthy. Some proof-of-concepts are malicious, e.g., they attempt to exfiltrate data from the system they are being run on, or they try to install malware on this system, and in some cases they have hard-coded reverse shell listener. To measure the prevalence of this threat, we propose an approach to detecting malicious PoCs. Our approach relies on the maliciousness symptoms we have observed in our PoC dataset: calls to malicious IP addresses, encoded malicious code, and included Trojanized binaries. With this approach, we have discovered 899 malicious repositories out of 47,285 repositories that have been downloaded and checked (i.e., 1.9% of the studied repositories have indicators of malicious intent). This figure shows a worrying prevalence of dangerous malicious PoCs among the exploit code distributed on GitHub.

翻译：漏洞概念验证代码（PoCs）在安全社区中被广泛共享。它们帮助安全分析师相互学习，并促进安全评估和红队任务。近年来，PoCs通过专用网站和平台以及GitHub等公共代码仓库广泛传播。然而，公共代码仓库中的PoCs是否来自可信来源，甚至是否如其声称般运行，都无法得到保证。在本工作中，我们调查了GitHub上针对2017-2021年发现的已知漏洞所托管的PoCs。我们发现并非所有PoCs都可信。部分概念验证代码具有恶意性，例如试图从运行系统中窃取数据，或尝试在该系统上安装恶意软件，某些情况下甚至包含硬编码的反向shell监听器。为衡量这一威胁的普遍性，我们提出一种检测恶意PoCs的方法。该方法依赖于我们在PoC数据集中观察到的恶意症状：对恶意IP地址的调用、编码的恶意代码以及包含的木马化二进制文件。通过此方法，我们在下载并检查的47,285个仓库中发现了899个恶意仓库（即1.9%的研究仓库存在恶意意图指标）。这一数据表明，在GitHub上分发的漏洞利用代码中，危险恶意PoCs的普遍程度令人担忧。