---
title: Hunt: Plex2Shell exploitation of Plex Media Server (loopback SSRF, sslip.io token theft, dump-yuv codec drop, XMRig/proxy IOCs) | ctxsec
url: https://ctxsec.com/items/hunt-plex2shell-exploitation
description: "Hunt for Plex2Shell (CVE-2026-96652/96654/96655/96656) exploitation of Plex Media Server: /player/timeline requests with a loopback protocol= URL, 127.0.0.1.*.sslip.io callbacks, TranscoderH264Options dump-yuv, unexpected .so/.dll files in Codecs, plus honeypot IOCs (4 IPs, XMRig and proxy hashes) from Oct 17, 2026."
status: "hunt idea (researcher IOCs), last updated Oct 18, 2026, 2:05 PM ET"
---

> Hunt for Plex2Shell (CVE-2026-96652/96654/96655/96656) exploitation of Plex Media Server: /player/timeline requests with a loopback protocol= URL, 127.0.0.1.*.sslip.io callbacks, TranscoderH264Options dump-yuv, unexpected .so/.dll files in Codecs, plus honeypot IOCs (4 IPs, XMRig and proxy hashes) from Oct 17, 2026.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-plex2shell-exploitation.md)

hunt idea (researcher IOCs)

2026-10-18

### Hunt: Plex2Shell exploitation of Plex Media Server (loopback SSRF, sslip.io token theft, dump-yuv codec drop, XMRig/proxy IOCs)

**Hunt for Plex2Shell (CVE-2026-96652/96654/96655/96656) exploitation of Plex Media Server: /player/timeline requests with a loopback protocol= URL, 127.0.0.1.*.sslip.io callbacks, TranscoderH264Options dump-yuv, unexpected .so/.dll files in Codecs, plus honeypot IOCs (4 IPs, XMRig and proxy hashes) from Oct 17, 2026.**

Context: [Plex2Shell alert](/items/plex-media-server-plex2shell-exploited-2026-10). IOCs come from one researcher's honeypot ([BoredHackerBlog](http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html), Oct 17-18, 2026). They are a starting point, not a full list, and the exploit's ports, hostnames and file names are easy to change.

#### IOCs (honeypot, Oct 17, 2026)

- `45.194.92.222`: exploitation source (also observed downloading payloads)
- `91.92.40.202`: exploitation source
- `176.65.139.228`: exploitation source
- `217.60.194.116`: payload download host (files "docker" and "x")

SHA-256:

- `5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441`: docker (dropper)
- `68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7`: x (UPX-packed miner)
- `b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49`: x (unpacked)
- `2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db`: xmrig
- `e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9`: myawesomeproxy (residential proxyware)

The researcher's sandbox runs of the proxy tool show traffic related to `proxystream.st`. Pcaps and samples: [BoredHackerBlog/plex2shell_pcap](https://github.com/BoredHackerBlog/plex2shell_pcap).

#### Network detections (web/proxy/Zeek logs for TCP 32400)

1. GET `/player/timeline/subscribe` or `/player/timeline/*` where `protocol=` holds a full URL, especially `http://127.0.0.1:32400/system/agents/` (the CVE-2026-96652 SSRF into CVE-2026-96654).
2. `identifier=` values containing `/function/GetResultFromNetwork`, or URL-encoded `?`/`#` (`%3F`, `%23`), in `searchOne` requests.
3. DNS lookups or outbound HTTP from the Plex host to names starting `127.0.0.1.` under `sslip.io` (or nip.io-style services). This is the owner-token theft step. The PoC defaults to ports 8952 (token), 8933 (carrier) and 9001 (reverse shell).
4. `PUT /:/prefs` setting `TranscoderH264Options`, and `/video/:/transcode/universal?path=http` pointing at an external host.
5. Low-signal hints: `User-Agent: Python-urllib/*` and client identifiers starting `poc_` in the honeypot traffic.

#### Host detections

1. `Preferences.xml`: any `TranscoderH264Options` containing `dump-yuv` or `stats=`.
2. Files in `Plex Media Server/Codecs/<set-id>-<platform>/` that don't match Plex's codec set (new `.so`/`.dll`, recent modification times, odd size or padding). A loaded file shows up as `(deleted)` under `/Codecs/` in `/proc/<pid>/maps`.
3. Child processes of `Plex Transcoder` or `Plex Media Server` that are shells, `curl`/`wget`, `xmrig`, or binaries in `/tmp`; `/dev/tcp` in command lines; sustained CPU on the Plex user.
4. The researcher's read-only [hunt script and YARA rules](https://github.com/code-zm/plex2shell/tree/main/detection) check for the items above (version, prefs, logs, Codecs, live processes). Read them before use; run them only on hosts you own.

```
# quick Linux triage (read-only)
grep -o 'TranscoderH264Options="[^"]*"' "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Preferences.xml"
find "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs" -type f -newermt 2026-10-15 -ls
ps -u plex -o pid,ppid,%cpu,etime,cmd --sort=-%cpu | head
sudo ss -tnp | grep -v -E 'Plex (Media Server|Transcoder|Relay)' 
```

Docker paths: the config sits under the host volume mapped to `/config`, at `Library/Application Support/Plex Media Server`.

Sources: [BoredHackerBlog honeypot report](http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html) · [Pcaps and samples](https://github.com/BoredHackerBlog/plex2shell_pcap) · [ZM write-up](https://zmain.info/blog/plex2shell) · [plex2shell detection (hunt script, YARA)](https://github.com/code-zm/plex2shell/tree/main/detection) · [CISA advisory VA-26-266-01](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json)