Windows PowerShell Invoke-WebRequest Command Injection RCE

This repository is a proof-of-concept (PoC) exploit for CVE-2025-54100, a remote code execution vulnerability affecting Windows PowerShell 5.1 when using Invoke-WebRequest without the -UseBasicParsing flag. The repository contains four files: a Python FastAPI server (app.py), a README.md with detailed usage and background, a requirements.txt for dependencies, and a LICENSE. The main exploit logic is in app.py, which serves a crafted HTML payload at the root HTTP endpoint. When a vulnerable Windows system accesses this endpoint (e.g., via Invoke-WebRequest or mshta), the HTML/JavaScript attempts to instantiate ActiveX objects to execute calc.exe, demonstrating RCE. The exploit is non-destructive and intended for research/validation. The README provides clear instructions for setup, exploitation, and mitigation. No hardcoded IPs are present in the code, but the README uses example IPs for demonstration. The attack vector is network-based, requiring the victim to access the attacker's HTTP server. The auxiliary /log endpoint is present for client-side logging but is not essential to the exploit. The PoC is mature as a demonstration but not weaponized for broader attacks.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-54100, a command injection vulnerability in Windows PowerShell 5.1's Invoke-WebRequest cmdlet. The repository contains four files: a Python exploit script (CVE-2025-54100.py), a README.md with detailed vulnerability and usage information, a .gitignore, and a requirements.txt listing FastAPI and Uvicorn as dependencies. The main exploit script implements a FastAPI web server that serves a crafted HTML/JavaScript payload at the root endpoint ('/'). When a vulnerable Windows PowerShell client fetches this endpoint using Invoke-WebRequest (without the -UseBasicParsing switch), the response is parsed by the MSHTML engine, which executes the embedded script. The current payload is non-malicious and simply triggers an alert for verification, but the mechanism demonstrates the potential for remote code execution. The exploit is network-based, requiring the victim to connect to the attacker's server. The repository is structured for easy use and testing, with clear instructions and mitigation advice in the README.