165 matches found
CVE-2025-8088-Multi-Document
WinRAR κ²½λ‘ νμ μ΅μ€νλ‘μ CVE-2025-8088 - λ€μ€ κΉμ΄ νμ΄λ‘λ λ°°ν¬ μ΄ Python μ€ν¬λ¦½νΈλ WinRARμ κ²½λ‘ νμpath traversal μ·¨μ½μ CVE-2025-8088μ μ μ©νμ¬ μ¬λ¬ μλ κ²½λ‘ κΉμ΄λ₯Ό μ¬μ©ν΄ Windows μμ ν΄λμ νμ΄λ‘λλ₯Ό λ°°ν¬ν©λλ€. μ΄ μ΅μ€νλ‘μμ μ μ± RAR μμΉ΄μ΄λΈλ₯Ό μμ±νλ©°, μμΆμ νλ©΄ λ€μν λλ ν°λ¦¬ κΉμ΄λ‘ νΌν΄μμ μμ ν΄λμ νμ΄λ‘λλ₯Ό κΈ°λ‘ν©λλ€. μ£Όμ κΈ°λ₯ π κ΅¬μ± κ°λ₯ν μ½ν μΈ λ‘ μ¬λ¬ μ μΈλ°μ½μ΄ νμΌ μμ± π ADSAlternate Data Streamsλ₯Ό ...
WinRAR-CVE-2025-8088-PoC-RAR
WinRAR-CVE-2025-8088-PoC-RAR WinRAR 0day CVE-2025-8088 PoC RAR μμΉ΄μ΄λΈ MyResumefinal.rar νμΌμ λ€μ΄λ‘λ λλ ν°λ¦¬μ λ£μ λ€μ, "Extract to MyResumefinal" μ΅μ μ μ¬μ©νκ±°λ μ§κΈμ μ·¨μ½ν WinRARμ UIλ₯Ό ν΅ν΄ μμΆμ νλ©΄ μ΅μ€νλ‘μμ΄ μ€νλ©λλ€! : κ·Έλ¬λ©΄ μμ νλ‘κ·Έλ¨ λλ ν°λ¦¬μ "WindowsConfigurationFileRun1.vbs"λΌλ VBScript νμΌμ΄ μμ±λλ κ²μ λ³Ό μ μμΌλ©°, μ»΄ν¨ν°κ° μ¬λΆν λλ©΄ "Exploit...
CVE-2025-6218-POC
CVE-2025-6218 κ°λ μ¦λͺ POC κ°μ μ΄ μ μ₯μλ WinRARμ μμΉ΄μ΄λΈ μΆμΆ κ²½λ‘ μ²λ¦¬μ κ΄λ ¨λ μ·¨μ½μ CVE-2025-6218μ μ μ©μ μμ°νλ κ°λ¨ν κ°λ μ¦λͺ POCμ ν¬ν¨ν©λλ€. POC λ°°μΉ μ€ν¬λ¦½νΈλ Windows μμ ν΄λμ λ°°μΉ νμΌμ λ°°μΉνλ ZIP μμΉ΄μ΄λΈλ₯Ό μμ±νλ©°, μ¬μ©μ λ‘κ·ΈμΈ μ calc.exeλ₯Ό μ€νν©λλ€. μλ λ°©μ λ°°μΉ μ€ν¬λ¦½νΈCVE-2025-6218.batλ Windows κ³μ°κΈ°calc.exeλ₯Ό μ€ννλ κ°λ¨ν λ°°μΉ νμΌPOC.batμ μμ±ν©λλ€. κ·Έλ° λ€μ WinRARμ μ¬μ©νμ¬ λ°°μΉ ν...
CVE-2025-8088
CVE 2025-8088μ λν POC WinRAR 7.13 λ―Έλ§ λ²μ μλ κ²½λ‘ μν μ·¨μ½μ μ΄ μμΌλ©°, μ΄λ μ§μμ μΈ μ격 μ Έλ‘ μ΄μ΄μ§ μ μμ΅λλ€. μμμ μμΉμμ .rar νμΌμ μΆμΆν λ κ²½λ‘ μνλ₯Ό μ¬μ©νμ¬ Startup ν΄λμ λ°μ΄λ리λ₯Ό λ°°μΉν©λλ€. μ¬μ©λ² python3 create-path-traversal-rar.py -p -o...
Malicious code in streak-bucket-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4145bc51e507e0a8b64d1267c16b0c9c8e80950a08bcf0a320b03fb8a1875b26 [email protected] advertises itself as a small dependency-free calendar/day-math helper library, but its declared main entry index.mjs is 521 ...
Malicious code in streak-math-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...
MAL-2026-12464 Malicious code in streak-daybucket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 799caca8e351ad8d1144b26eb0c38ffdf06afb415f63a320e6ea455968996aa0 [email protected] presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Windows PE binary leading 4D5A90...
Malicious code in streak-daybucket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 799caca8e351ad8d1144b26eb0c38ffdf06afb415f63a320e6ea455968996aa0 [email protected] presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Windows PE binary leading 4D5A90...
MAL-2026-12461 Malicious code in streak-daily-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7 [email protected]'s main entry index.mjs runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to...
Malicious code in streak-daily-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7 [email protected]'s main entry index.mjs runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to...
Malicious code in streak-math-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a [email protected] is advertised as a math primitives library but its index.mjs top-level IIFE bootstrap runs on any import and drops a hex-embedd...
MAL-2026-12468 Malicious code in streak-math-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a [email protected] is advertised as a math primitives library but its index.mjs top-level IIFE bootstrap runs on any import and drops a hex-embedd...
Malicious code in streak-calendar-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...
Malicious code in streak-day-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82 index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants process, fetch, childprocess,...
MAL-2026-12422 Malicious code in quorvex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5 [email protected] ships index.mjs as the package main, containing a base64-encoded Windows PE 355KB in a PAYLOAD constant. At import time on Windows host...
Malicious code in quorvex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5 [email protected] ships index.mjs as the package main, containing a base64-encoded Windows PE 355KB in a PAYLOAD constant. At import time on Windows host...
Malicious code in calendar-streak-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34b4caa6716625380bd2636072e5fe0473d114ab3fdfd8335f9e1c0e642ddc4 [email protected] is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE...
Malicious code in streak-count-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d391f9ec30841fdf31ec1afeeb309a1e8895c445c811a1a1f7f3e0a754c5e4fa [email protected]'s index.mjs executes a hex-obfuscated routine on module import gated only by NODEENV!== 'production'. When it detects a WSL...
MAL-2026-11148 Malicious code in streak-core-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34 [email protected] presents itself as a 'day-math primitives' library, but index.mjs the package main, executed on any require/import contains an...
MAL-2026-11149 Malicious code in streak-core-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073175f6a0065dc5cc00d30357053432c69fbc7aab8b92bbe4217ad3d54c5d3a index.mjs executes a top-level async IIFE on import that fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip, unzips it into...