box-js

box.js A utility to analyze malicious JavaScript. Installation Simply install box-js from npm: root@kitploit: npm install box-js --global box-js is also available: as a Cuckoo module see the integrations directory and Nwinternights/CuckooBoxjs; as a Dockerfile see integrations/README.md; as a...

CVE-2017-8625_Bypass_UMCI

what is ! Windows Defender Device Guard ! Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity...

ZipExec

ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...

AMSI-Bypass

AMSI-Bypass AMSI 触发器列表（VBA、JScript / VBScript） 参考 : MISC 104 - AMSI: Fonctionnement et Contournements 在 VBA、JScript 和 VBScript 中，AMSI 使用循环缓冲区记录指令，并维护一份被认为可疑的函数列表。使用这些黑名单函数中的任何一个，都会触发已注册的 AMSI 提供程序对循环缓冲区进行扫描。 本仓库包含以 CRC32 校验和形式定义的触发器列表，这些列表来自 VBE7.DLL、jscript.dll 和 vbscript.dll。列表采用 CSV...

CVE-2020-0674

CVE-2020-0674 CVE-2020-0674 是传统 jscript 引擎中的一个释放后使用漏洞。可在 Internet Explorer 中触发。此处的利用代码由 maxpl0it 编写，但漏洞本身由 Qihoo 360 发现，且已在野外被利用。该利用仅用于弹出计算器。 可在此处找到利用分析文章。 漏洞概述 该漏洞存在于使用比较函数时的 Array sort 方法中。 比较函数的两个传入参数未被垃圾回收器追踪，因此在垃圾回收被调用后，它们将指向已释放的内存。 利用说明 该利用代码专门针对 Windows 7 编写，但可能无需太多麻烦即可移植。 该利用代码针对 x64 版本的 ...

CVE-2020-0674-Exploit

CVE-2020-0674 CVE-2020-0674 是旧版 jscript 引擎中的一个释放后使用漏洞。可在 Internet Explorer 中触发。此处的利用代码由 maxpl0it 编写，但漏洞本身由 Qihoo 360 在野发现。该利用代码仅弹出计算器。 漏洞利用分析文章可在此处找到。 漏洞概述 该漏洞存在于使用比较函数时的数组 sort 函数中。 提供给比较函数的两个参数未被垃圾回收器跟踪，因此在垃圾回收被调用后将指向已释放的内存。 利用说明 该利用代码专门为 Windows 7 编写，但移植起来可能不会太麻烦。 此利用代码适用于 IE 的 x64...

Malicious code in transform-jscript (npm)

The package 'transform-jscript' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1505 Malicious code in transform-jscript (npm)

The package 'transform-jscript' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023

Cybersecurity researchers have discovered a JScript-based command-and-control C2 framework called PeckBirdy that has been put to use by China-aligned APT actors since 2023 to target multiple environments. The flexible framework has been put to use against Chinese gambling industries and malicious...

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities...

EUVD-2015-6078

Malware in sbrugna...

EUVD-2018-20053

Malware in sbrugna...

EUVD-1999-1074

Malware in sbrugna...

Malicious Windows Script Host JScript (.js) File

This module creates a Windows Script Host WSH JScript .js file. Module Options msf use exploit/windows/fileformat/windowsscripthostjscript msf exploitwindowsscripthostjscript show targets ...targets... msf exploitwindowsscripthostjscript set TARGET msf exploitwindowsscripthostjscript show options...

📄 Malicious Windows Script Host JScript File

This Metasploit module creates a Windows Script Host WSH JScript .js file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Malicious Windows Script Host JScript .js File', 'Description' = %q Th...

📄 Microsoft Windows Server 2025 JScript Engine Remote Code Execution

This proof of concept exploits a use-after-free vulnerability in jscript.dll to achieve code execution via heap spraying. The shellcode executes calc.exe as a demonstration of code execution. !/usr/bin/env python3 Exploit Title: Microsoft Windows Server 2025 JScript Engine - Remote Code Execution...

Microsoft Windows Server 2025 JScript Engine - Remote Code Execution (RCE)

!/usr/bin/env python3 Exploit Title: Microsoft Windows Server 2025 JScript Engine - Remote Code Execution RCE Exploit Author: Mohammed Idrees Banyamer Instagram: @@banyamersecurity GitHub: https://github.com/mbanyamer Date: 2025-05-31 CVE: CVE-2025-30397 Vendor: Microsoft Affected Versions: Windo...

Exploit for Type Confusion in Microsoft

CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Fre...

CVE-2023-1004

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit h...

Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT

Recent months have seen a surge in mailings with lookalike email attachments in the form of a ZIP archive containing JScript scripts. The script files – disguised as requests and bids from potential customers or partners – bear names such as "Запрос цены и предложения от Индивидуального...