CVE-2025-49144

Notepad++ 二进制植入 PoC CVE-2025-49144 ⚠️ 仅供教育目的 本代码专为教育和研究目的而设计，用于理解二进制植入漏洞。请仅在受控环境且获得适当授权的情况下使用。 📋 概述 此概念验证（PoC）演示了 Notepad++ 安装程序中的二进制植入漏洞（CVE-2025-49144），该漏洞已在 GHSA-9vx8-v79m-6m24 中提及。攻击者可通过在与 Notepad++ 安装程序相同的目录中放置名为 regsvr32.exe 的恶意可执行文件来获得 SYSTEM 级权限。 🎯 漏洞详情 目标 ：Notepad++ 安装程序（v8.8.2 之前的所有版本） 方...

JSRat-Py

JSRat-Py これは、JSRat.ps1 を Python で実装したものです。PowerShell が有効な Windows OS に制限されることなく、任意の OS で攻撃サーバーを実行できるようになりました。 rundll32 または regsvr32 のいずれかの方法によるクライアント呼び出しを処理するサポートを追加しました。 参考文献と元プロジェクト: regsvr32: https://gist.github.com/subTee/24c7d8e1ff0f5602092f58cbb3f7d302 rundll32:...

CVE-2025-49144_PoC

CVE-2025-49144PoC 📌 CVE-2025-49144 는 Notepad++ v8.8.1 및 이전 버전 설치 프로그램에서 발견된 심각도가 높은 로컬 권한 상승 취약점입니다. 이 취약점은 설치 중 제어되지 않은 실행 파일 검색 경로 동작으로 인해 발생하며, 로컬 공격자가 설치 프로그램과 동일한 디렉토리에 악성 실행 파일을 배치하여 SYSTEM 수준의 권한을 얻을 수 있게 합니다. ⚙️ CVE 작동 방식 – 단계별 설명 : 🧱 1. 설치 프로그램에서 무엇이 잘못되었나요? Notepad++ 설치 프로그램v8.8.2 이전은...

notepad-v8.8.1-LPE-CVE-

notepad-v8.8.1-LPE-CVE- CVE-2025-49144 Notepad++ v8.8.1 SYSTEMレベルのPoC 📌 CVE-2025-49144は、Notepad++ v8.8.1およびそれ以前のバージョンのインストーラに見つかった、深刻度の高いローカル権限昇格の脆弱性です。この脆弱性は、インストール中に制御不能な実行可能ファイルの検索パス動作に起因し、ローカルの攻撃者がインストーラと同じディレクトリに悪意のある実行可能ファイルを配置することで、SYSTEMレベルの権限を取得することを可能にします。 ⚙️ CVEの仕組み – ステップバイステップ: 🧱 1...

PowerShdll

PowerShdll dll만으로 PowerShell을 실행합니다. powershell.exe에 접근할 필요 없이 PowerShell 자동화 dll을 사용합니다. PowerShdll은 rundll32.exe, installutil.exe, regsvcs.exe, regasm.exe, regsvr32.exe 또는 독립 실행형 실행 파일로 실행할 수 있습니다. dll 모드: Rundll32: root@kitploit: Usage: rundll32 PowerShdll,main rundll32 PowerShdll,main -h 이 메시...

Notepad-8.8.1_CVE-2025-49144

CVE-2025-49144 – Notepad++ 8.8.1 用エクスプロイト このリポジトリには、Notepad++ 8.8.1 インストーラー のCVE-2025-49144 脆弱性を悪用する実用的なProof of Concept（PoC）が含まれています。この悪意のある実行は、脆弱なインストーラーと同じディレクトリにバイナリ（regsvr32.exe）を配置することで発生します。インストーラーが実行されると、コンテキストを継承してペイロードがトリガーされます。 ⚠️ 免責事項 このコードは教育および研究目的...

ContextMenuHijack

ContextMenuHijack 这个启发我的原始创意来自 @NinjaParanoid： ContextMenuHijack 是一种基于人类行为、利用 COM 劫持的简单持久化技术：当你在文件资源管理器中右键单击文件/文件夹以打开上下文菜单时，它会在同一时间执行我们指定的 beacon。 root@kitploit: IFACEMETHODIMP FileContextMenuExt::Initialize LPCITEMIDLIST pidlFolder, LPDATAOBJECT pDataObj, HKEY hKeyProgID DWORD tid = NULL;...

CVE-2025-63685

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of regsvr32.exe it loads. An attacker can place a crafted malicious DLL in the application's...

EUVD-2025-198336

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of regsvr32.exe it loads. An attacker can place a crafted malicious DLL in the application's...

Exploit for CVE-2025-49144

CVE-2025-49144PoC 📌 CVE-2025-...

Regsvr32.exe (.sct) Command Delivery Server

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Regsvr32.exe .sct Command Delivery Server', 'Description' = %q This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a w...

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection. "Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel XLM 4.0 to trick...

Researchers Warn of 'Raspberry Robin' Malware Spreading via External Drives

Cybersecurity researchers have discovered a new Windows malware with worm-like capabilities and is propagated by means of removable USB devices. Attributing the malware to a cluster named "Raspberry Robin," Red Canary researchers noted that the worm "leverages Windows Installer to reach out to...

Exchange Servers Speared in IcedID Phishing Campaign

The ever-evolving banking trojan IcedID is back again with a phishing campaign that uses previously compromised Microsoft Exchange servers to send emails that appear to come from legitimate accounts. Attackers also are using stealthy new payload-delivery tactics to spread the modular malware...

Cybercriminals Swarm Windows Utility Regsvr32 to Spread Malware

A Windows living-off-the-land binary LOLBin known as Regsvr32 is seeing a big uptick in abuse of late, researchers are warning, mainly spreading trojans like Lokibot and Qbot. LOLBins are legitimate, native utilities used daily in various computing environments, that cybercriminals use to evade...

Living Off the Land: How to Defend Against Malicious Use of Legitimate Utilities

Living-off-the-land binaries LOLBins are no joke: Cyberattackers have been increasingly making use of them to hide their malicious work from security solutions. It’s time for threat hunters and IT security staff to familiarize themselves with how these are used in the attack chains of some of the...

The vulnerability of the operating environment of the information protection software “Blockhost-Net” and “Blockhost-Net K” allows a perpetrator to execute the application through the operating system’s regsvr32 component, bypassing the closed-loop programming environment.

The vulnerability of the operating environments of the information protection software “Blockhost-Net” and “Blockhost-Net K” is related to the use of the regsvr32 function to access system components. Exploiting this vulnerability could allow a perpetrator with administrative privileges to execut...

Chinese APT group targets India and Hong Kong using new variant of MgBot malware

This blog post was authored by Hossein Jazi and Jérôme Segura On July 2, we found an archive file with an embedded document pretending to be from the government of India. This file used template injection to drop a malicious template which loaded a variant of Cobalt Strike. One day later, the sam...

Watch Out! Microsoft Spotted Spike in Astaroth Fileless Malware Attacks

Security researchers at Microsoft have released details of a new widespread campaign distributing an infamous piece of fileless malware that was primarily being found targeting European and Brazilian users earlier this year. Dubbed Astaroth, the malware trojan has been making the rounds since at...

New malware found using Google Drive as its command-and-control server

Since most security tools also keep an eye on the network traffic to detect malicious IP addresses, attackers are increasingly adopting infrastructure of legitimate services in their attacks to hide their malicious activities. Cybersecurity researchers have now spotted a new malware attack campai...