Invoke-PSImage

Invoke-PSImage PowerShellスクリプトをPNGファイルのピクセルにエンコードし、実行するためのワンライナーを生成します Invoke-PSImageはPowerShellスクリプトを受け取り、そのスクリプトのバイトをPNG画像のピクセルにエンコードします。ファイルから、またはウェブから実行するためのワンライナーを生成します。...

sccmsqlclient

sccmsqlclient 专用于 SCCM 数据库探索与利用的 MSSQL 客户端。 侦察查询 在受管客户端上运行 PowerShell 脚本 提取机密 安装 PIPX $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PIP 您可以通过克隆仓库并安装依赖项来安装。 $ git clone https://github.com/synacktiv/sccmsqlclient $ cd sccmsqlclient $ python3 -m venv .venv && source .venv/bin/activa...

nimrm

nimrm Native WinRM shell client written in Nim Version 1.2.0 · Author Chokri Hammedi blue0x1 · License MIT Legal Notice nimrm is intended for lawful administration, security testing, and research on systems you own or have explicit permission to access. The author is not responsible for misuse or...

DSCourier_BOF

DSCourier BOF 这是 Dylan Davis 和 Matthew Schramm 的 DSCourier 项目的 BOF 实现。它使用 WinGet 的 COM 接口在微软签名且受信任的进程中执行任意 PowerShell 代码。他们的完整研究博客可以在这里找到。 与我发布的大多数项目不同，这并非一个可直接投入使用的工具，而更像是一个概念验证（POC）。在发现了若干阻碍其成为可部署 BOF 的问题后，我决定不再进一步推进。代码几乎完全由 AI 生成（clanked）。仍有多个问题尚未解决，将在下文讨论。 用法 将你的任意 PowerShell 代码放入 dist/rev.ym...

PowerShx

SharpShx DLLまたはスタンドアロン実行ファイルを使用したアンマネージドPowerShellの実行。 はじめに PowerShxは、PowerShdllプロジェクトを書き直し、拡張したものです。PowerShxは、AMSIをバイパスし、PSコマンドレットを実行する機能を提供します。 特徴 rundll32.exe、installutil.exe、regsvcs.exe、regasm.exe、regsvr32.exeを使用してDLLでPowerShellを実行。 powershell.exeやpowershellise.exeを使用せずにPowerShellを実行。...

Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

DKMC

私の猫を殺さないで（DKMC） WINDOWS 10 now limit the shellcode payload from running properly due to the need of a RWX page to decode and execute the shellcode. DKMC can be update the set a memory page with properly permission. 「Don't kill my...

CcmMessagingBackdoor

CcmMessagingBackdoor 用于构建并安装恶意的 CcmMessaging 服务，以在管理点上维持访问权限的概念验证工具 使用方法 在管理点上编译并安装恶意的 COM 服务 Compile PS C:\ C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe /t:library /out:c:\rogue.dll RogueCcmEndpoint.cs Register CLSID PS C:\ C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. C2 基础设施 – 弹性与冗余服务器 Process Hacker 内存分析揭示了一组由 Dropper GCleaner 用于 C2 通信的域名列表。这些域名托管在多种平台上（Scaleway、Render、Replit 等），表明其基础设施健壮且冗余。 关键观察： 托管平台： Scaleway scw.cloud、Render onrender.com、Replit repl.co 等。 域名： readthedocs.io、rhcloud.com、app.render.com、id.repl.co、resindevice.io 等。 用途：...

Follina_MSDT_CVE-2022-30190

Microsoft解释说，“当使用URL协议从调用应用程序（如Word）调用MSDT时，存在远程代码执行漏洞。成功利用此漏洞的攻击者可以使用调用应用程序的权限运行任意代码。然后，攻击者可以在用户权限允许的上下文中安装程序、查看、更改或删除数据，或创建新帐户”。https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/...

Malicious code in better-envforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...

MAL-2026-16324 Malicious code in better-envforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51 [email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifie...

Malicious code in @solana-js/web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a...

Linux Distros Unpatched Vulnerability : CVE-2026-71312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP...

PT-2026-68331

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath function only escapes ASCII apostrophes, failing to account for...

Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

HTTP transports expose unauthenticated PowerShell control with wildcard CORSThere is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling...

PYSEC-2026-3425 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

HTTP transports expose unauthenticated PowerShell control with wildcard CORS There is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling...

Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...

MAL-2026-6576 Malicious code in checkmarx-claude-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...