CVE-2017-8464-exp-generator

CVE-2017-8464-exp-generator このツールは、cve-2017-8486 用のエクスプロイトを生成できます。Python で開発されています。 使用方法: CVE-2017-8464.py dllname 実行すると、A.lnk、B.lnk、...、Z.lnk という名前の 26 個のファイルが生成されます。 その後、dll ファイルを A:/、B:/、...、Z:/ のいずれかのドライブに配置する必要があります。 例えば、 すべての .lnk ファイルと dll ファイルを USB に入れた場合、USB がコンピュータに接続されると、dll が実行されます。...

CVE-2025-33053-Checker-PoC

CVE-2025-33053 脆弱性チェッカー＆概念実証 PoC チェッカーの証明 PoCの証明 Windows システムに影響を与える、WebDAV ベースの重要なリモートコード実行 RCE 脆弱性 CVE-2025-33053 の悪用可能性をチェックし、実証するためのツール一式です。 📌 CVE-2025-33053 について CVE-2025-33053 は、攻撃者が悪意のあるリモート WebDAV 共有を参照する .LNK ショートカットファイルを悪用し、影響を受けるシステム上でリモートコード実行 RCE を引き起こす可能性を許容します。 脆弱性の条件： 対象に WebClien...

CVE-2025-9491_POC

CVE-2025-9491 LNK 난독화 PoC Windows 바로가기.lnk 파일 취약점ZDI-CAN-25373/CVE-2025-9491을 시연하기 위한 개념 증명 도구입니다. 이 도구는 공백 문자 패딩을 활용하여 악성 명령줄 인수를 .lnk 파일 내에 숨길 수 있는 방법을 보여줍니다. 이 도구는 교육 및 승인된 보안 테스트 목적으로만 제공됩니다. 허가 없이 컴퓨터 시스템에 접근하는 것은 불법입니다. 이 도구는 본인이 소유하거나 명시적 테스트 허가를 받은 시스템에서만 사용하십시오. 목차 설명 취약점 세부정보 설치 사용법 생성 ...

CVE-2026-40029 parseusbs < 1.9 Command Injection via Crafted LNK Filename

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen shell command, allowing arbitrary command execution via crafted .lnk filenames containing shell metacharacters. An attacker can craft a .lnk filename wi...

DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

Threat actors likely associated with the Democratic People's Republic of Korea DPRK have been observed using GitHub as command-and-control C2 infrastructure in multi-stage attacks targeting organizations in South Korea. The attack chain, per Fortinet FortiGuard Labs, involves obfuscated Windows...

China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

A China-affiliated threat actor known as UNC6384 has been linked to a fresh set of attacks exploiting an unpatched Windows shortcut vulnerability to target European diplomatic and government entities between September and October 2025. The activity targeted diplomatic organizations in Hungary,...

EUVD-2020-8891

Malware in sbrugna...

EUVD-2018-10272

Malware in sbrugna...

EUVD-2004-2662

Malware in sbrugna...

EUVD-1999-0280

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2018-12096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The liblnkdatastringgetutf8stringsize function in liblnkdatastring.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure...

Patchwork Targets Turkish Defense Firms with Spear-Phishing Using Malicious LNK Files

The threat actor known as Patchwork has been attributed to a new spear-phishing campaign targeting Turkish defense contractors with the goal of gathering strategic intelligence. "The campaign employs a five-stage execution chain delivered via malicious LNK files disguised as conference invitation...

UNG0002 Group Hits China, Hong Kong, Pakistan Using LNK Files and RATs in Twin Campaigns

Multiple sectors in China, Hong Kong, and Pakistan have become the target of a threat activity cluster tracked as UNG0002 aka Unknown Group 0002 as part of a broader cyber espionage campaign. "This threat entity demonstrates a strong preference for using shortcut files LNK, VBScript, and...

Exploit for External Control of File Name or Path in Microsoft

CVE-2025-33053 Vulnerability Checker & Proof-of-Concept PoC...

Fileless Remcos RAT Delivered via LNK Files and MSHTA in PowerShell-Based Attacks

Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. "Threat actors delivered malicious LNK files embedded within ZIP archives, often disguised as Office documents," Qualys...

Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT

Cybercriminals are progressively turning PowerShell to launch stealthy attacks that evade traditional antivirus and endpoint defenses. By running code directly in memory, these threats leave minimal evidence on disk, making them particularly challenging to detect. A recent example is Remcos RAT, ...

Fileless Remcos RAT Attack Evades Antivirus Using PowerShell Scripts

A new wave of attacks uses PowerShell and LNK files to secretly install Remcos RAT, enabling full remote…...

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

Cisco Talos is actively tracking an ongoing campaign targeting users in Ukraine with malicious LNK files, which run a PowerShell downloader, since at least November 2024. The file names use Russian words related to the movement of troops in Ukraine as a lure. The PowerShell downloader contacts...

New Stealer Uses Invalid Cert To Compromise Systems

New Stealer Uses Invalid Cert To Compromise Systems By Mohinder Gill, Mallikarjun Wali and Sangram Mohapatro · November 07, 2024 A new Stealer has been making the rounds. Its name: Fickle. Fickle Stealer is a new Rust-based information stealer that spreads through various attack vectors, includin...

Finding the LNK: Techniques and methodology for advanced analysis with Velociraptor

Malicious exploitation of LNK files, commonly known as Windows shortcuts, is a well-established technique used by threat actors for delivery and persistence. While the value of LNK forensics for cyber threat intelligence CTI is fairly well-understood, analysts may overlook less well-known data...