CVE-2017-8759 PoC — Microsoft .NET Framework 安全漏洞

Source

https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Associated Vulnerability

Title:Microsoft .NET Framework 安全漏洞 (CVE-2017-8759)
Description:Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."

Description

Running CVE-2017-8759 exploit sample.

Readme

# CVE-2017-8759-Exploit-sample
Running CVE-2017-8759 exploit sample.



Flow of the exploit:

Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe



To test:

Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python3 -m http.server -127.0.0.1 8080
Or you can use python3 server.py

If all is good mspaint should run.

Mohammed Aldoub @Voulnet

## References:

https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!