CVE-2022-39197

This repository contains a functional exploit for CVE-2022-39197, leveraging SVG file manipulation and Frida-based process injection to achieve remote code execution. The exploit uses a malicious JAR file embedded in an SVG to trigger payload execution when the target process (e.g., beacon.exe) is enumerated.

This repository provides a functional Java agent-based patch for CVE-2022-39197, a Cobalt Strike XSS vulnerability. It hooks the `isHTMLString` method in `javax.swing.plaf.basic.BasicHTML` to disable HTML rendering, mitigating the XSS risk.

This PoC exploits CVE-2022-39197 by crafting a malicious packet with a Cobalt Strike beacon-like structure, encrypting it with RSA, and sending it to a target server via a cookie header. The payload includes an HTML image tag to trigger remote image loading, demonstrating the vulnerability.

This repository contains a functional proof-of-concept exploit for CVE-2022-39197, an XSS vulnerability in Cobalt Strike teamserver versions <=4.7 that can lead to RCE. The exploit crafts a malicious Beacon configuration with an XSS payload to trigger remote code execution via a malformed username.

The repository claims to include a modified version of Cobalt Strike 4.4 with patches for CVE-2022-39197 but provides no actual exploit code or technical details. It focuses on marketing features like 'free kill' and 'authentication changes' without demonstrating the vulnerability.

The repository claims to address CVE-2022-39197 but provides no technical details or exploit code, instead referencing a DMCA-taken-down project and listing file hashes. It appears to be a lure for cracked software rather than a legitimate PoC.

This repository contains a functional exploit for CVE-2022-39197, a stored XSS vulnerability in Cobalt Strike that can lead to RCE. The PoC crafts a malicious payload, encrypts it using RSA, and sends it via a crafted HTTP request to exploit the vulnerability.

This repository contains a functional exploit for CVE-2022-39197, leveraging Frida to inject a malicious SVG payload into a process named 'beacon.exe', triggering remote code execution via Apache Batik's JSVGCanvas. The exploit includes a Java-based payload (Exploit.java) that executes arbitrary commands based on the target OS.

This repository contains a functional proof-of-concept for mitigating CVE-2022-39197, an XSS vulnerability in Cobalt Strike's use of javax.swing.JLabel. The PoC uses ByteBuddy to inject an interceptor that disables HTML rendering in JLabel components, preventing XSS exploitation.

This PoC demonstrates a Java Swing XSS-to-RCE vulnerability (CVE-2022-39197) by embedding malicious SVG content in a Swing application. The SVGHandler class executes arbitrary commands (e.g., 'calc') when an SVGLoad event is triggered, while demo.java loads and renders the malicious payload.

The repository contains minimal content with a placeholder README and an empty or redacted Python script. No functional exploit code or technical details are provided.

This repository contains a GUI-based tool for testing and exploiting CVE-2023-21839 (WebLogic RCE), CVE-2022-39197 (CobaltStrike RCE), and CVE-2023-28432 (MinIO info leak). It includes functional PoC code for WebLogic RCE via JNDI injection and CobaltStrike RCE via Frida-based process manipulation.

This repository contains a functional exploit for CVE-2022-39197, leveraging SVG file processing in Apache Batik to achieve remote code execution. The exploit includes a Java-based payload (Exploit.java) and a Frida-based injection script (cve-2022-39197.py) to trigger the vulnerability.

This repository provides a technical summary of CVE-2022-39197, an XSS vulnerability in Cobalt Strike's Beacon software that can lead to RCE on the CS server. It includes references, screenshots, and external links but lacks functional exploit code.

This repository provides a detailed technical analysis of Cobalt Strike 4.5's licensing mechanism, including reverse engineering of the authentication process, key extraction, and methods to bypass license checks. It also covers techniques to remove checksum8 and BeaconEye detection features.

This repository contains a functional Python script that simulates a Cobalt Strike beacon connection packet, including metadata structure and RSA encryption, to mimic a beacon checking in with a C2 server. It demonstrates the protocol and encryption used by CVE-2022-39197.