71 matches found
PowerShx
SharpShx 使用 DLL 或独立可执行文件进行非托管 PowerShell 执行。 介绍 PowerShx 是基于 PowerShdll 项目重写和扩展的版本。PowerShx 提供了绕过 AMSI 和运行 PowerShell Cmdlet 的功能。 特性 使用 rundll32.exe、installutil.exe、regsvcs.exe、regasm.exe、regsvr32.exe 通过 DLL 运行 PowerShell。 无需 powershell.exe 或 powershellise.exe 即可运行 PowerShell。 具备 AMSI 绕过功能。...
nopowershell
NoPowerShell NoPowerShell es una herramienta implementada en C que permite ejecutar comandos similares a los de PowerShell permaneciendo invisible a cualquier mecanismo de registro de PowerShell. Este binario compatible con .NET Framework 2 puede cargarse en Cobalt Strike para ejecutar comandos e...
PowerShdll
PowerShdll 仅使用dll运行PowerShell。 无需访问powershell.exe，因为它使用PowerShell自动化dll。 PowerShdll可通过rundll32.exe、installutil.exe、regsvcs.exe、regasm.exe、regsvr32.exe或以独立可执行文件运行。 dll模式： Rundll32： Usage: rundll32 PowerShdll,main rundll32 PowerShdll,main -h Display this message rundll32 PowerShdll,main -f Run the...
ThreatHunting
ThreatHunting I am publishing GPL v3 tools for hunting for threats in your organisations. Nexthink modules Threat hunting - Potential malware downloads v1.0.xml This is a report which shows all calls to internet domains from common malware document techniques. Most endpoint malware - such as...
JSRat-Py
JSRat-Py This is my implementation of JSRat.ps1 in Python so you can now run the attack server from any OS instead of being limited to a Windows OS with Powershell enabled. Added support to handle client invocation via either rundll32 or regsvr32 methods References & Original Project: regsvr32:...
CVE-2021-40444
CVE-2021-40444 completamente armado Generador de docx malicioso para explotar CVE-2021-40444 ejecución remota de código en Microsoft Office Word, funciona con archivos DLL arbitrarios. Antecedentes Aunque hay muchos PoC por ahí en internet, decidí probar suerte armando esta vulnerabilidad, ya que...
ExecIT
ExecIT Description DLL Shellcode self-inyector/runner based on HWSyscalls, ideally thought to be executed with rundll32. May grant fileless execution if victim endpoint has access to attacker-controlled SMB share. Usage rundll32.exe ExecIT.dll, HelperFunc, Detection Currently it is fully undetect...
ZeroRAT
ZeroRAT Introducción Herramienta de control remoto RAT para Windows. El cliente solo necesita ejecutar una única instrucción; utiliza programas nativos de Windows para ejecutarse, no escribe archivos en el disco y cuenta con características naturales de evasión de antivirus. Deja de funcionar tra...
CVE-2018-9276
CVE-2018-9276 PRTG 18.2.39 Authenticated Command Injection Reverse Shell https://nvd.nist.gov/vuln/detail/CVE-2018-9276 Improved version of an exploit written by https://github.com/M4LV0. I used the POST data from their script but just made it more reliable as I didnt have much success with it...
MAL-2026-6357 Malicious code in theme-color-picker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...
Malicious code in theme-color-picker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...
CVE-2026-25865 Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll ControlRunDLL input.dll. Attacker...
CVE-2026-25865: Unquoted Search Path or Element
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll ControlRunDLL input.dll. Attacker...
CVE-2025-66576
Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution...
EUVD-2025-201265
Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution...
CVE-2025-66576
Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution...
CVE-2025-66576
Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution...
CVE-2025-66576 Remote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)
Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution...
CVE-2025-66576
CVE-2025-66576 affects Remote Keyboard Desktop 1.0.1. The vulnerability stems from the rundll32.exe export function named “export,” which allows remote attackers to execute system commands and achieve unauthenticated code execution. Public sources in the provided set reiterate the RCE impact but ...
Remotecontrolio Remote Keyboard Desktop 操作系统命令注入漏洞
Remotecontrolio Remote Keyboard Desktop is a remote control application from Remotecontrolio. An operating system command injection vulnerability exists in Remotecontrolio Remote Keyboard Desktop version 1.0.1, which stems from a flaw in the rundll32.exe export function that could lead to...