You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: db/modules_metadata_base.json
+40Lines changed: 40 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -253371,6 +253371,46 @@
253371
253371
"payload_type": 1,
253372
253372
"staged": false
253373
253373
},
253374
+
"payload_windows/aarch64/exec": {
253375
+
"name": "Windows AArch64 Command Execution",
253376
+
"fullname": "payload/windows/aarch64/exec",
253377
+
"aliases": [],
253378
+
"rank": 300,
253379
+
"disclosure_date": null,
253380
+
"type": "payload",
253381
+
"author": [
253382
+
"alanfoster",
253383
+
"Alexander \"xaitax\" Hagenah"
253384
+
],
253385
+
"description": "Executes an arbitrary command on a Windows on ARM (AArch64) target.\n This payload is a foundational example of position-independent shellcode for the AArch64 architecture.\n It dynamically resolves the address of the `WinExec` function from `kernel32.dll` by parsing the\n Process Environment Block (PEB) and the module's Export Address Table (EAT) at runtime.\n This technique avoids static imports and hardcoded function addresses, increasing resilience.",
0 commit comments