Invoke-PSImage

Invoke-PSImage Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute Invoke-PSImage takes a PowerShell script and encodes the bytes of the script into the pixels of a PNG image. It generates a oneliner for executing either from a file of from the web. It can...

sccmsqlclient

sccmsqlclient SCCM 데이터베이스 탐색 및 공격을 위한 전용 MSSQL 클라이언트입니다. 정찰 쿼리 관리 대상 클라이언트에서 PowerShell 스크립트 실행 비밀 정보 추출 설치 PIPX $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PIP 저장소를 클론하고 의존성을 설치하여 설치할 수 있습니다. $ git clone https://github.com/synacktiv/sccmsqlclient $ cd sccmsqlclient $ python3 -...

nimrm

nimrm Nim으로 작성된 네이티브 WinRM 셸 클라이언트 버전 1.2.0 · 작성자 Chokri Hammedi blue0x1 · 라이선스 MIT 법적 고지 nimrm은 본인이 소유하거나 명시적으로 접근 권한을 부여받은 시스템에 대한 합법적인 관리, 보안 테스트 및 연구를 목적으로 합니다. 작성자는 이 도구의 오용이나 이로 인한 손해에 대해 책임지지 않습니다. 목차 개요 기능 요구 사항 설치 빌드 성능 사용법 옵션 대화형 명령어 세션 관리 예제 참고 사항 라이선스 개요 nimrm은 실용적인 인증, 명령 실행, 전송 및 보고...

DSCourier_BOF

DSCourier BOF 이것은 Dylan Davis와 Matthew Schramm의 DSCourier 프로젝트의 BOF 구현입니다. WinGet의 COM 인터페이스를 사용하여 Microsoft에서 서명하고 신뢰하는 프로세스에서 임의의 powershell 코드를 실행합니다. 전체 연구 블로그는 여기에서 확인할 수 있습니다. 내가 출시하는 대부분의 프로젝트와 달리, 이 도구는 운영 준비가 된 도구가 아니라 오히려 POC에 가깝습니다. 이 BOF를 쉽게 배포할 수 있도록 하는 데 방해가 되는 여러 문제를 발견한 후 더 이상 추진하...

PowerShx

SharpShx Unmanaged PowerShell execution using DLLs or a standalone executable. Introduction PowerShx is a rewrite and expansion on the PowerShdll project. PowerShx provide functionalities for bypassing AMSI and running PS Cmdlets. Features Run Powershell with DLLs using rundll32.exe,...

Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

DKMC

Don't Kill My Cat DKMC WINDOWS 10 now limit the shellcode payload from running properly due to the need of a RWX page to decode and execute the shellcode. DKMC can be update the set a memory page with properly permission. Don't kill my cat is a tool that generates obfuscated shellcode that is...

CcmMessagingBackdoor

CcmMessagingBackdoor Management Point에 대한 액세스를 유지하기 위해 가짜 CcmMessaging 서비스를 빌드하고 설치하는 PoC 도구 사용법 Management Point에 가짜 COM 서비스를 컴파일하고 설치합니다 Compile PS C:\ C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe /t:library /out:c:\rogue.dll RogueCcmEndpoint.cs Register CLSID PS C:...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. C2インフラストラクチャ – 耐障害性と冗長性を備えたサーバー Process Hackerのメモリ解析により、Dropper GCleanerがC2通信に使用するドメインの包括的なリストが明らかになりました。これらのドメインはさまざまなプラットフォーム（Scaleway、Render、Replitなど）でホストされており、堅牢で冗長性のあるインフラストラクチャを示しています。 主な観察結果: ホスティングプロバイダー: Scaleway scw.cloud、Render onrender.com、Replit repl.co など。 ドメイン:...

Follina_MSDT_CVE-2022-30190

Microsoft는 "Word와 같은 호출 애플리케이션이 URL 프로토콜을 사용하여 MSDT를 호출할 때 원격 코드 실행 취약점이 존재합니다. 이 취약점을 성공적으로 악용한 공격자는 호출 애플리케이션의 권한으로 임의 코드를 실행할 수 있습니다. 그런 다음 공격자는 프로그램을 설치하거나, 데이터를 보거나 변경·삭제하거나, 사용자 권한이 허용하는 범위 내에서 새 계정을 만들 수 있습니다"라고 설명합니다...

Malicious code in better-envforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...

MAL-2026-16324 Malicious code in better-envforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Linux Distros Unpatched Vulnerability : CVE-2026-71312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP...

PT-2026-68331

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath function only escapes ASCII apostrophes, failing to account for...

Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

HTTP transports expose unauthenticated PowerShell control with wildcard CORSThere is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling...

PYSEC-2026-3425 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

HTTP transports expose unauthenticated PowerShell control with wildcard CORS There is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling...

Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...

MAL-2026-6576 Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...