Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

DSCourier_BOF

DSCourier BOF This is a BOF implementation of Dylan Davis and Matthew Schramm's DSCourier project. It uses WinGet's COM interface to execute arbitrary powershell code in a Microsoft signed and trusted process. Their full research blog can be found here. Unlike most projects I release, this is NOT...

PowerShx

SharpShx 使用 DLL 或独立可执行文件进行非托管 PowerShell 执行。 介绍 PowerShx 是基于 PowerShdll 项目重写和扩展的版本。PowerShx 提供了绕过 AMSI 和运行 PowerShell Cmdlet 的功能。 特性 使用 rundll32.exe、installutil.exe、regsvcs.exe、regasm.exe、regsvr32.exe 通过 DLL 运行 PowerShell。 无需 powershell.exe 或 powershellise.exe 即可运行 PowerShell。 具备 AMSI 绕过功能。...

sccmsqlclient

sccmsqlclient Un cliente MSSQL dedicado para la exploración y explotación de bases de datos SCCM. Consultas de reconocimiento Ejecutar scripts de PowerShell en clientes administrados Extraer secretos Instalación PIPX root@kitploit: $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PI...

nimrm

nimrm Cliente de shell WinRM nativo escrito en Nim Versión 1.2.0 · Autor Chokri Hammedi blue0x1 · Licencia MIT...

Invoke-PSImage

Invoke-PSImage 将 PowerShell 脚本编码到 PNG 图像的像素中，并生成一行命令来执行 Invoke-PSImage 获取一个 PowerShell 脚本，并将脚本的字节编码到 PNG 图像的像素中。它生成一行命令，用于从文件或从 Web 执行。 它既可以仅使用 payload 数据创建新图像，也可以将 payload 嵌入到现有图像的最低有效字节中，使其看起来像是一张真实的图片。图像保存为 PNG 格式，可以进行无损压缩而不会影响执行 payload 的能力，因为数据存储在颜色本身中。在创建新图像时，普通的 PowerShell 脚本实际上会被显著压缩，通常生成...

DKMC

别杀我的猫 DKMC Windows 10 现在限制了 shellcode 载荷的正常运行，因为需要 RWX 页面来解码和执行 shellcode。DKMC 可以更新以设置具有适当权限的内存页面。 别杀我的猫是一款工具，它能生成存储在多重图像中的混淆 shellcode。该图像 100% 有效，同时也是 100% 有效的 shellcode。其思路是避免沙箱分析，因为它只是一张简单的“合法”图像。目前该工具依赖 PowerShell 来执行最终的 shellcode 载荷。 为什么叫“别杀我的猫”？因为我不擅长为工具起名，所以决定利用默认 BMP 图像是一只猫的事实来命名。...

CcmMessagingBackdoor

CcmMessagingBackdoor Herramienta de prueba de concepto para construir e instalar un servicio CcmMessaging rogue para mantener acceso en un Management Point Uso Compilar e instalar el servicio COM rogue en el Management Point root@kitploit: Compile PS C:...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. Infraestructura C2: servidores resilientes y redundantes El análisis de memoria con Process Hacker revela una lista completa de dominios utilizados por el Dropper GCleaner para la comunicación C2. Estos dominios están alojados en varias plataformas Scaleway, Render, Replit, etc., lo que indica...

Follina_MSDT_CVE-2022-30190

Microsoft explains that “a remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker ca...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Linux Distros Unpatched Vulnerability : CVE-2026-71312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP...

PT-2026-68331

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath function only escapes ASCII apostrophes, failing to account for...

Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

PYSEC-2026-3425 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

HTTP transports expose unauthenticated PowerShell control with wildcard CORS There is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling...

Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...

MAL-2026-6576 Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...

CVE-2026-48989

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS alloworigins=, allowmethods=, allowheaders=. Because the same server also exposed a...

CVE-2026-48989 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS alloworigins=, allowmethods=, allowheaders=. Because the same server also exposed a...

CVE-2026-48989 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS alloworigins=, allowmethods=, allowheaders=. Because the same server also exposed a...