Invoke-DOSfuscation

Invoke-DOSfuscation v1.0 Introducción Invoke-DOSfuscation es un framework de ofuscación de comandos de cmd.exe compatible con PowerShell v2.0+. Documento técnico: https://www.fireeye.com/blog/threat-research/2018/03/dosfuscation-exploring-obfuscation-and-detection-techniques.html Antecedentes...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 介绍 Out-FINcodedCommand 是一个兼容 PowerShell v2.0+ 的 PowerShell POC 脚本，旨在突出显示 FIN 威胁行为者使用的几种混淆技术。此工具重点展示的混淆技术包括： 1. cmd.exe 的变量字符/字符串替换功能 2. cmd.exe 和 powershell.exe 的标准输入命令调用能力 3. 环境变量子字符串功能，用于混淆 "cmd" 和 "powershell" 安装 Out-FINcodedCommand 的源代码托管在 Github 上，您可以从该仓库...

CVE-2024-24576-Exploit

CVE-2024-24576-Exploit Command::arg 和 Command::args API 在其文档中声明，参数将原封不动地传递给生成的进程，无论参数内容如何，并且不会被 shell 求值。这意味着将不受信任的输入作为参数传递应该是安全的。 在 Windows 上，此功能的实现比其他平台更复杂，因为 Windows API 只提供一个包含所有参数的单一字符串给生成的进程，而由生成的进程自行分割它们。大多数程序使用标准的 C 运行时 argv，这实际上导致参数分割方式基本一致。 然而，有一个例外是...

conti-ransomware-writeup

Report sul Ransomware Conti Panoramica Questo repository contiene la mia indagine completa e il report tecnico di un compromesso ransomware Conti che ha preso di mira un server Microsoft Exchange. L'analisi è stata condotta utilizzando Splunk 8.2.2 , esaminando 28.145 eventi provenienti da fonti ...

CVE-2020-0796-LPE-POC

CVE-2020-0796 POC di Elevazione dei Privilegi Locali c 2020 ZecOps, Inc. - https://www.zecops.com - Trova gli errori degli attaccanti POC per verificare CVE-2020-0796 / "SMBGhost" Risultato atteso: cmd.exe avviato con accesso di sistema Destinato solo a scopi educativi e di test in ambienti...

CVE-2026-73414

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-73414 Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-73414

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-49402

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:childprocess implementation provided an escapeShellArg helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.e...

CVE-2026-49402

Deno is affected by CVE-2026-49402 on Windows when using node:child_process with shell: true. The escapeShellArg() helper failed to properly quote arguments containing cmd.exe metacharacters (e.g., &, |, , ^, !, (, )), and did not neutralize % inside double-quoted strings. This allowed an attacke...

CVE-2026-49402

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:childprocess implementation provided an escapeShellArg helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.e...

CVE-2026-52750

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click...

📄 Remote Sunrise Helper for Windows 2026.14 UAC Bypass

Remote Sunrise Helper for Windows version 2026.14 suffers from a local UAC bypass vulnerability via the Icon Import dialog. Exploit Title: Remote Sunrise Helper for Windows 2026.14 - UAC Bypass via Icon Import Dialog Date: 2026-04-20 Exploit Author: Chokri Hammedi Software:...

CVE-2026-22168

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments throug...

CVE-2026-22168

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments throug...

CVE-2026-22168

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments throug...

CVE-2026-28391

OpenClaw vulnerability CVE-2026-28391 affects OpenClaw versions prior to 2026.2.2. The issue stems from improper validation of Windows cmd.exe metacharacters in allowlist-gated exec requests, allowing remote attackers to bypass command approval and craft command strings with shell metacharacters ...

OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments

Summary A Windows system.run approval-integrity mismatch in the cmd.exe /c path could allow trailing arguments to execute while approval/audit text reflected only a benign command string. This requires an authenticated operator context using the approvals flow and a trusted Windows node. Affected...

OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

Summary On Windows nodes, exec requests were executed via cmd.exe /d /s /c . In allowlist/approval-gated mode, the allowlist analysis did not model Windows cmd.exe parsing and metacharacter behavior. A crafted command string could cause cmd.exe to interpret additional operations for example comma...

CVE-2024-39613

Mattermost Desktop App versions =5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine...