CVE-2015-1641 PoC — Microsoft Office 内存损坏漏洞

Source

Associated Vulnerability

Description

Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents

Readme

# rtf_exploit_extractor
Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents

	usage: rtfexploit_extract.py [-h] [-o OUTFILE] [-d DECOY] [-l LENGTH] [-v] inputfile
	
	
	inputfile             exploit document to examine
	
	optional arguments:
	
		-h, --help			show this help message and exit
	  
	  	-o OUTFILE, --outfile OUTFILE
	  						output filename for extracted payload
	  						
		-d DECOY, --decoy DECOY
							output filename for extracted decoy document
							
	  	-l LENGTH, --length LENGTH
							length of each marker to search for (def: 7)
							
		-v                    print debug messages


All args are optional except for input filename.

Ref: http://blog.malwareclipboard.com/2015/10/rtf-exploit-document-extraction.html

File Snapshot

 [4.0K]  /data/pocs/0d5afb6c8cc73fa843def691dbb3997f51d92a6f
├── [ 782]  README.md
└── [7.4K]  rtfexploit_extract.py

0 directories, 2 files

Remarks