PowerShdll

PowerShdll Run PowerShell with dlls only. Does not require access to powershell.exe as it uses powershell automation dlls. PowerShdll can be run with: rundll32.exe, installutil.exe, regsvcs.exe, regasm.exe, regsvr32.exe or as a standalone executable. dll mode: Rundll32: root@kitploit: Usage:...

CVE-2025-49144

Notepad++ Binary Planting PoC CVE-2025-49144 ⚠️ EDUCATIONAL PURPOSE ONLY This code is designed for educational and research purposes to understand binary planting vulnerabilities. Use only in controlled environments with proper authorization. 📋 Overview This Proof of Concept demonstrates the binar...

JSRat-Py

JSRat-Py これは、JSRat.ps1 を Python で実装したものです。PowerShell が有効な Windows OS に制限されることなく、任意の OS で攻撃サーバーを実行できるようになりました。 rundll32 または regsvr32 のいずれかの方法によるクライアント呼び出しを処理するサポートを追加しました。 参考文献と元プロジェクト: regsvr32: https://gist.github.com/subTee/24c7d8e1ff0f5602092f58cbb3f7d302 rundll32:...

CVE-2025-49144_PoC

CVE-2025-49144PoC 📌 CVE-2025-49144 is a high-severity local privilege escalation vulnerability found in the Notepad++ v8.8.1 and prior version installers. This vulnerability stems from uncontrolled executable search path behavior during installation, allowing a local attacker to gain SYSTEM-level...

notepad-v8.8.1-LPE-CVE-

notepad-v8.8.1-LPE-CVE- CVE-2025-49144 Notepad++ v8.8.1 SYSTEM-level POC 📌 CVE-2025-49144 is a high-severity local privilege escalation vulnerability found in the Notepad++ v8.8.1 and prior version installers. This vulnerability stems from uncontrolled executable search path behavior during...

Notepad-8.8.1_CVE-2025-49144

CVE-2025-49144 – Notepad++ 8.8.1 用エクスプロイト このリポジトリには、Notepad++ 8.8.1 インストーラー のCVE-2025-49144 脆弱性を悪用する実用的なProof of Concept（PoC）が含まれています。この悪意のある実行は、脆弱なインストーラーと同じディレクトリにバイナリ（regsvr32.exe）を配置することで発生します。インストーラーが実行されると、コンテキストを継承してペイロードがトリガーされます。 ⚠️ 免責事項 このコードは教育および研究目的...

ContextMenuHijack

ContextMenuHijack 这个启发我的原始创意来自 @NinjaParanoid： ContextMenuHijack 是一种基于人类行为、利用 COM 劫持的简单持久化技术：当你在文件资源管理器中右键单击文件/文件夹以打开上下文菜单时，它会在同一时间执行我们指定的 beacon。 root@kitploit: IFACEMETHODIMP FileContextMenuExt::Initialize LPCITEMIDLIST pidlFolder, LPDATAOBJECT pDataObj, HKEY hKeyProgID DWORD tid = NULL;...

CVE-2025-63685

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of regsvr32.exe it loads. An attacker can place a crafted malicious DLL in the application's...

EUVD-2025-198336

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of regsvr32.exe it loads. An attacker can place a crafted malicious DLL in the application's...

Exploit for CVE-2025-49144

CVE-2025-49144PoC 📌 CVE-2025-...

Regsvr32.exe (.sct) Command Delivery Server

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Regsvr32.exe .sct Command Delivery Server', 'Description' = %q This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a w...

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection. "Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel XLM 4.0 to trick...

Researchers Warn of 'Raspberry Robin' Malware Spreading via External Drives

Cybersecurity researchers have discovered a new Windows malware with worm-like capabilities and is propagated by means of removable USB devices. Attributing the malware to a cluster named "Raspberry Robin," Red Canary researchers noted that the worm "leverages Windows Installer to reach out to...

Exchange Servers Speared in IcedID Phishing Campaign

The ever-evolving banking trojan IcedID is back again with a phishing campaign that uses previously compromised Microsoft Exchange servers to send emails that appear to come from legitimate accounts. Attackers also are using stealthy new payload-delivery tactics to spread the modular malware...

Cybercriminals Swarm Windows Utility Regsvr32 to Spread Malware

A Windows living-off-the-land binary LOLBin known as Regsvr32 is seeing a big uptick in abuse of late, researchers are warning, mainly spreading trojans like Lokibot and Qbot. LOLBins are legitimate, native utilities used daily in various computing environments, that cybercriminals use to evade...

Living Off the Land: How to Defend Against Malicious Use of Legitimate Utilities

Living-off-the-land binaries LOLBins are no joke: Cyberattackers have been increasingly making use of them to hide their malicious work from security solutions. It’s time for threat hunters and IT security staff to familiarize themselves with how these are used in the attack chains of some of the...

The vulnerability of the operating environment of the information protection software “Blockhost-Net” and “Blockhost-Net K” allows a perpetrator to execute the application through the operating system’s regsvr32 component, bypassing the closed-loop programming environment.

The vulnerability of the operating environments of the information protection software “Blockhost-Net” and “Blockhost-Net K” is related to the use of the regsvr32 function to access system components. Exploiting this vulnerability could allow a perpetrator with administrative privileges to execut...

Chinese APT group targets India and Hong Kong using new variant of MgBot malware

This blog post was authored by Hossein Jazi and Jérôme Segura On July 2, we found an archive file with an embedded document pretending to be from the government of India. This file used template injection to drop a malicious template which loaded a variant of Cobalt Strike. One day later, the sam...

Watch Out! Microsoft Spotted Spike in Astaroth Fileless Malware Attacks

Security researchers at Microsoft have released details of a new widespread campaign distributing an infamous piece of fileless malware that was primarily being found targeting European and Brazilian users earlier this year. Dubbed Astaroth, the malware trojan has been making the rounds since at...

New malware found using Google Drive as its command-and-control server

Since most security tools also keep an eye on the network traffic to detect malicious IP addresses, attackers are increasingly adopting infrastructure of legitimate services in their attacks to hide their malicious activities. Cybersecurity researchers have now spotted a new malware attack campai...