-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – Iniezione in svchost tramite chiamate API Native Il seguente frammento di Binary Ninja rivela il meccanismo di iniezione principale utilizzato da Remcos per iniettare il suo payload in svchost.exe. Cosa fa questo codice: CreateProcessW con il flag CREATESUSPENDED avvia un nuovo...

livewire-honeypot

Livewire Honeypot Un honeypot ad alta interazione che si maschera da applicazione Laravel/Livewire vulnerabile. Cattura i tentativi di exploit che mirano a CVE note di Livewire, archivia file malevoli caricati webshell e payload di remote code execution RCE con deduplicazione SHA-256 e,...

Johnson Controls Metasys 12.x / 13.x / 14.x < 14.1.5 / 15.x < 15.0.1 Cross-Site Scripting (CVE-2026-34491)

A low-privilege user can inject a malicious XSS payload into the Johnson Controls Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. Successful exploitation of this vulnerability could allow a low-privileg...

follina.py

'Follina' MS-MSDT n-day Microsoft Office RCE Schneller POC zur Reproduktion der 'Follina'-Office-RCE-Schwachstelle für lokale Testzwecke. Das Ausführen des Skripts erzeugt eine Payload-Datei clickme.docx oder clickme.rtf in Ihrem aktuellen Arbeitsverzeichnis und startet einen Webserver mit der...

SharpWnfSuite

SharpWnfSuite Questo è il repository per gli strumenti di Windows Notification Facility WNF. Attualmente, è stata caricata una versione in C degli strumenti presenti in wnfun sviluppati da Alex Ionescu @aionescu e Gabrielle Viala @pwissenlit. Quando sviluppero ulteriori strumenti per Windows...

Anti-Virus-Evading-Payloads

🚩 Anti-Virus-Evading-Payloads !CAUTION Durante la fase di exploitation di un penetration test o di un engagement di ethical hacking, dovrai in ultima analisi cercare di far eseguire codice sui computer dei sistemi target. Che avvenga tramite email di phishing, consegna di un payload attraverso un...

fire-wall-server

🛡️ Mitigação de Firewall Spring4Shell Script Python Este projeto simula um firewall usando o módulo http.server nativo do Python para detectar e bloquear requisições maliciosas que exploram a vulnerabilidade Spring4Shell CVE-2022-22965. 🔍 Sobre Spring4Shell é uma vulnerabilidade crítica de Execuçã...

api_wordlist

apiwordlist Une wordlist de noms d'API utilisée pour le fuzzing des API d'applications web. Contenu apiseeninwild.txt - Contient des noms de fonctions d'API que j'ai rencontrés dans la nature. actions.txt - Tous les verbes de noms de fonctions d'API objects.txt - Tous les noms substantifs de noms...

CVE-2015-8351

gwollebuster este script é um exploit para o plugin antigo do WordPress gwolle uso: ./gwollebuster.py primeiro argumento = a url do seu alvo do WordPress que tem gwolle instalado segundo argumento = seu ip terceiro argumento = porta de escuta para o reverse shell exemplo: ./gwollebuster.py...

Malicious code in @syncraft-labs/vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f The ESM build dist/index.js of @syncraft-labs/[email protected] contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin...

MAL-2026-14369 Malicious code in @syncraft-labs/vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f The ESM build dist/index.js of @syncraft-labs/[email protected] contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin...

Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

MAL-2026-14367 Malicious code in @syncraft-labs/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...

CVE-2026-3424

The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.4.10.3 . The root cause is improper validation of the payload parameter before passing it to do_shortcode, allowing an...

CVE-2026-3424 kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

EUVD-2026-64250

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

EUVD-2026-64248

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-66917

JoomGallery (a Joomla extension) versions prior to 4.3.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with privileged access can embed an XSS payload in any image, resulting in JavaScript execution in the browser of every visitor who views the affected ...

CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...