LazySign

LazySign 윈도우 바이너리와 배치 파일의 힘을 사용하여 바이너리용 가짜 인증서 생성 수년 동안, 바이너리 파일의 서명을 도용하거나 위조하는 데 능숙한 몇 가지 멋진 도구들이 출시되었습니다. 그러나 이러한 도구들은 모두 Go, Python 등과 같은 추가 종속성이 필요합니다. 이 저장소는 추가 종속성 없이 가짜 서명을 할 수 있는 기회를 제공합니다. 사용되는 모든 바이너리는 Microsoft 자체 개발 키트의 일부입니다. 편의를 위해 배치 파일을 작성했습니다. Invoke-LazySign.ps1 PowerShell 스크립트...

CVE-2026-31999

OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attackers to influence execution behavior through cwd manipulation. Remote attackers can exploit improper shell execution...

PT-2026-26239

Summary On Windows ACPX paths, wrapper resolution for .cmd/.bat could fall back to shell execution in ways that allowed cwd influence to alter execution behavior. Impact In affected Windows ACPX configurations, this could enable command execution integrity loss through cwd-influenced wrapper...

LazySign - Create Fake Certs For Binaries Using Windows Binaries And The Power Of Bat Files

Create fake certs for binaries using windows binaries and the power of bat files Over the years, several cool tools have been released that are capeable of stealing or forging fake signatures for binary files. All of these tools however, have additional dependencies which require Go,python,... Th...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - Crescendo

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo By Jessica Saavedra-Morales · October 20, 2019 Episode 4: Crescendo This is the final installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandGrab, the most prolific...

Apache HTTP Server Remote Command Execution via .bat files

The Apache HTTP Server 2.0.x Win32 installation is shipped with a default script, /cgi-bin/test-cgi.bat, that allows an attacker to execute commands on the Apache server although it is reported that any .bat file could open this vulnerability. SPDX-FileCopyrightText: 2002 Matt Moore Some text...

Apache Remote Command Execution via .bat files

The Apache 2.0.x Win32 installation is shipped with a default script, /cgi-bin/test-cgi.bat, that allows an attacker to execute commands on the Apache server although it is reported that any .bat file could open this vulnerability. An attacker can send a pipe character with commands appended as...

Code execution in Win32 Apache via .bat files

If server uses .bat files as CGI it's possible to execute any shell commands by using pipes...

sambar.bat.txt

PRODUCT ------- The Sambar Server is a multi-threaded HTTP, FTP and Proxy server for Windows NT and Windows 95. AFFECTED VERSIONS ----------------- All version of Sambar server running under Windows NT 4.0 and Windows 2000. Windows 98 version is vulnerable. VULNERABILITY DESCRIPTION...