Invoke-PSImage

Invoke-PSImage Kodiert ein PowerShell-Skript in die Pixel einer PNG-Datei und generiert einen Einzeiler zur Ausführung Invoke-PSImage nimmt ein PowerShell-Skript und kodiert die Bytes des Skripts in die Pixel eines PNG-Bildes. Es generiert einen Einzeiler zur Ausführung entweder von einer Datei...

Follina_MSDT_CVE-2022-30190

Microsoft erklärt, dass „eine Remote-Codeausführungsschwachstelle vorliegt, wenn MSDT über das URL-Protokoll von einer aufrufenden Anwendung wie Word aufgerufen wird. Ein Angreifer, der diese Schwachstelle erfolgreich ausnutzt, kann beliebigen Code mit den Berechtigungen der aufrufenden Anwendung...

DKMC

Don't Kill My Cat DKMC WINDOWS 10 ora limita il corretto funzionamento del payload shellcode a causa della necessità di una pagina RWX per decodificare ed eseguire lo shellcode. DKMC può essere aggiornato per impostare una pagina di memoria con i permessi appropriati. Don't kill my cat è uno...

PowerShx

SharpShx Esecuzione di PowerShell non gestita tramite DLL o un eseguibile autonomo. Introduzione PowerShx è una riscrittura e un'espansione del progetto PowerShdll. PowerShx offre funzionalità per bypassare AMSI ed eseguire Cmdlet PS. Caratteristiche Eseguire PowerShell con DLL usando rundll32.ex...

Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

CcmMessagingBackdoor

CcmMessagingBackdoor Strumenti proof of concept per creare e installare un servizio CcmMessaging non autorizzato per mantenere l'accesso a un Management Point Utilizzo Compilare e installare il servizio COM non autorizzato sul Management Point root@kitploit: Compile PS C:...

sccmsqlclient

sccmsqlclient Ein spezieller MSSQL-Client zum Erkunden und Ausnutzen von SCCM-Datenbanken. Recon-Abfragen PowerShell-Skripte auf verwalteten Clients ausführen Geheimnisse extrahieren Installation PIPX root@kitploit: $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PIP Sie können das...

DSCourier_BOF

DSCourier BOF Esta é uma implementação BOF do projeto DSCourier de Dylan Davis e Matthew Schramm. Utiliza a interface COM do WinGet para executar código powershell arbitrário em um processo assinado e confiável da Microsoft. O blog completo da pesquisa pode ser encontrado aqui. Ao contrário da...

nimrm

nimrm Cliente de shell WinRM nativo escrito em Nim Versão 1.2.0 · Autor Chokri Hammedi blue0x1 · Licença MIT...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. Infrastruttura C2 – Server Resilienti e Ridondanti L'analisi della memoria di Process Hacker rivela un elenco completo di domini utilizzati dal Dropper GCleaner per la comunicazione C2. Questi domini sono ospitati su varie piattaforme Scaleway, Render, Replit, ecc., indicando un'infrastruttura...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Linux Distros Unpatched Vulnerability : CVE-2026-71312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP...

Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

PYSEC-2026-3425 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

HTTP transports expose unauthenticated PowerShell control with wildcard CORS There is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling...

Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...

MAL-2026-6576 Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...

CVE-2026-48989

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS alloworigins=, allowmethods=, allowheaders=. Because the same server also exposed a...

CVE-2026-48989 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS alloworigins=, allowmethods=, allowheaders=. Because the same server also exposed a...

CVE-2026-48989 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS alloworigins=, allowmethods=, allowheaders=. Because the same server also exposed a...

EUVD-2026-32671

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path. In affected releases, ShellReceiver.runshell passes a command string...