446 matches found
box-js
box.js Una utilidad para analizar JavaScript malicioso. Instalación Simplemente instala box-js desde npm: root@kitploit: npm install box-js --global box-js también está disponible: como módulo de Cuckoo consulta el directorio integrations y Nwinternights/CuckooBoxjs; como Dockerfile consulta...
CVE-2017-8625_Bypass_UMCI
Qué es ! Windows Defender Device Guard ! Windows Defender Device Guard es una combinación de funciones de seguridad de hardware y software relacionadas con la empresa que, cuando se configuran juntas, bloquean un dispositivo para que solo pueda ejecutar aplicaciones confiables que defina en sus...
ZipExec
ZipExec ZipExec 是一个概念验证 POC 工具，用于将基于二进制的工具封装到受密码保护的 zip 文件中。该 zip 文件随后被 base64 编码成一个字符串，并重新构建到磁盘上。这个编码后的字符串被加载到一个 JScript 文件中，执行时会将受密码保护的 zip 文件重新构建到磁盘并执行它。这是通过使用 COM 对象以编程方式实现的，利用 Windows 中的 GUI 函数通过生成的 JScript 加载器，无需先解压即可直接执行受密码保护的 zip 内的加载器。通过密码保护 zip 文件，可以保护二进制文件免受 EDR 以及基于磁盘或反恶意软件扫描机制的影响。 安装...
AMSI-Bypass
AMSI-Bypass Lists of AMSI triggers VBA, JScript / VBScript Reference : MISC 104 - AMSI: Fonctionnement et Contournements In VBA, JScript and VBScript, AMSI uses a circular buffer to log instructions and a list of believed suspicious functions. The use of one of those blacklisted functions trigger...
CVE-2020-0674
CVE-2020-0674 CVE-2020-0674 is a use-after-free vulnerability in the legacy jscript engine. It can be triggered in Internet Explorer. The exploit here is written by maxpl0it but the vulnerability itself was discovered by Qihoo 360 being used in the wild. This exploit simply pops calc. Exploit...
CVE-2026-69438
Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network...
CVE-2026-69325
Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker to execute code over a network...
EUVD-2026-73496
Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network...
CVE-2026-69438
CVE-2026-69438 is a Remote Code Execution vulnerability in Microsoft JScript caused by an incorrect conversion between numeric types . An unauthorized attacker can exploit this over a network to execute code, with a CVSS 3.1 score of 8.1 (HIGH) — notably, high attack complexity is required but no...
EUVD-2026-73218
Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker to execute code over a network...
CVE-2026-69325
CVE-2026-69325 is a heap-based buffer overflow in Microsoft JScript that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.1 (High) , with a network attack vector, high complexity, no required privileges or user interaction, and high impact o...
CVE-2020-0674-Exploit
CVE-2020-0674 CVE-2020-0674 es una vulnerabilidad de use-after-free en el motor jscript heredado. Se puede activar en Internet Explorer. El exploit aquí está escrito por maxpl0it, pero la vulnerabilidad en sí fue descubierta por Qihoo 360 al ser utilizada en ataques reales. Este exploit simplemen...
Microsoft JScript Remote Code Execution Vulnerability
Incorrect conversion between numeric types in Microsoft JScript allows an unauthorized attacker to execute code over a network...
Malicious code in transform-jscript (npm)
The package 'transform-jscript' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
MAL-2026-1505 Malicious code in transform-jscript (npm)
The package 'transform-jscript' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
Cybersecurity researchers have discovered a JScript-based command-and-control C2 framework called PeckBirdy that has been put to use by China-aligned APT actors since 2023 to target multiple environments. The flexible framework has been put to use against Chinese gambling industries and malicious...
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups
PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities...
EUVD-2018-20053
Malware in sbrugna...