vbsmin

VBSmin VBScript minifier Features ⬜️ Remove extra whitespace Trailing whitespace Leading whitespace Blank lines Inline extra spaces 💬 Remove comments Single quote start of the line Single quote inline REM 1️⃣ One-line Line splitting underscore Colon Quick start Quick install $ gem install vbsmin...

msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

EDRUnChoker

EDRUnChoker Fileless WMI remediation forEDRChoker counters QoS abuse pacer.sys that throttles EDR agents to near-zero network bandwidth. Registers a permanent subscription in root\subscription no files on disk. A 5-second timer runs embedded VBScript that enumerates QoS policies with...

SMBRat

SMBRat A Windows Remote Administration Tool in Visual Basic Script Idea Windows Environments like Active Directory Networks, get really bloated with SMB traffic. All hosts get Policies from the SYSVOL , configurations need remote files to work, desktop shortcuts tend to point to...

SignHere

SignHere Introduction CVE-2017-11882 - The unique vulnerability identifier of Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allows an attacker to run code in the context of the current user without...

Malicious code in studiocode_eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc package.json declares a postinstall hook wscript.exe 4444.vbs that automatically executes a 765KB VBScript shipped in the tarball on Windows...

e013

e013 A little VBScript that steal Wifi passwords from Windows Into the file WifiName.txt you can see the password of every saved wifi available on every windows computer that support VBscript ⚠️ Don't modify the script with notepad, use text editor like GNU Emacs, Vim, Atom, Vscode, Sublime text...

cve-2018-8174_analysis

Dissecting modern browser exploit: case study of CVE-2018-8174 Overview When this exploit first emerged in the turn of April and May it spiked my interest, since despite heavy obfuscation, the code structure seemed well organized and the vulnerability exploitation code small enough to make analys...

WinRAR-CVE-2025-8088-PoC-RAR

WinRAR-CVE-2025-8088-PoC-RAR WinRAR 0day CVE-2025-8088 PoC RAR Archive Place the MyResumefinal.rar in the Downloads Directory and extract using "Extract to MyResumefinal" or from the UI using the Vulnerable WinRAR for now to run the exploit! : you'll see a VBScript named:...

MS16-051-poc

CVE-2016-0189 Proof-of-Concept exploit for CVE-2016-0189 VBScript Memory Corruption in IE11 Tested on Windows 10 IE 11. Write-up https://www.deamwork.com/archives/patch-analysis-of-cve-2016-0189.orz6 To run 1. Download support/.dll or compile .cpp for yourself and exploit/.html to a directory. 2...

vbsmin

VBSmin VBScript ミニファイア 特徴 ⬜️ 余分な空白を削除 末尾の空白 先頭の空白 空行 インラインの余分なスペース 💬 コメントを削除 シングルクォート（行頭） シングルクォート（インライン） REM 1️⃣ 一行化 行分割（アンダースコア） コロン クイックスタート クイックインストール $ gem install vbsmin より多くのインストールオプションをご覧ください。 デフォルトの使用方法: CLI $ vbsmin samples/features.vbs Original file size: 344 bytes Minified file size:...

ruler

简介 Ruler 是一款工具，允许你通过 MAPI/HTTP 或 RPC/HTTP 协议远程与 Exchange 服务器交互。其主要目标是滥用 Outlook 客户端侧的特性，远程获取一个 Shell。 关于 Ruler 的实现细节以及 MAPI 的背景信息，可以在我们的博客文章中找到： Ruler 发布 使用 Ruler 进行哈希传递 Outlook 表单与 Shell Outlook 主页——另一个 Ruler 攻击向量 查看实际演示： YouTube 上的 Ruler 它能做什么？ Ruler 拥有多项功能，未来还计划添加更多功能。这些功能包括： 枚举有效用户 创建新的恶意邮件规则...

CVE-2018-8174

CVE-2018-8174 MS Word MS WordPad via IE VBS Engine RCE MS Word and MS WordPad RCE via IE VBS RCE https://github.com/smgorelik/Windows-RCE-exploits/tree/master/Web/VBScript Save the index.html to webserver then use the python script to generate RTF Exploit Shellcode is static Down\Exec Putty.exe...

CVE-2018-8174-msf

CVE-2018-8174-msf This is a metasploit module which creates a malicious word document to exploit CVE-2018-8174 - VBScript memory corruption vulnerability. This module is a very quick port and uses the exploit sample that was found in the wild. The exploit works only for Microsoft Office 32-bit...

CVE-2017-11882

CVE-2017-11882 Original script from https://github.com/embedi/CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Research:...

CVE-2018-8174-msf

CVE-2018-8174-msf This is a metasploit module which creates a malicious word document to exploit CVE-2018-8174 - VBScript memory corruption vulnerability. This module is a very quick port and uses the exploit sample that was found in the wild. The exploit works only for Microsoft Office 32-bit...

vbSparkle

vbSparkle とは？ vbSparkle は、部分評価に基づくソースコード間のマルチプラットフォーム Visual Basic 難読化解除ツール であり、主に VBScript と VBA（Office マクロ）で書かれた悪意のあるコードの解析を目的としています。 ネイティブ C で書かれており、.Net Standard ライブラリ を提供します。Windows、Linux、MacOS などで動作します。 Visual Basic Script と VBA のパースは、ANTLR の文法＆レクサーパーサーを使用して処理されます。 セットアップ パッケージマネージャー...

ie11_vbscript_exploit

IE11 VBScript Exploit Exploit Generator for CVE-2018-8174 & CVE-2019-0768 RCE via VBScript Execution in IE11 Prerequisite Metasploit msfvenom Usage python ie11vbscript.py Listener IP Listener Port Instruction 1. Use this script to generate "exploit.html" 2. Host the html file on your server 3...

AMSI-Bypass

AMSI-Bypass Lists of AMSI triggers VBA, JScript / VBScript Reference : MISC 104 - AMSI: Fonctionnement et Contournements In VBA, JScript and VBScript, AMSI uses a circular buffer to log instructions and a list of believed suspicious functions. The use of one of those blacklisted functions trigger...

Malicious code in booking-eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The...