CVE-2018-8174 PoC — Microsoft Windows VBScript引擎缓冲区错误漏洞

Source

Associated Vulnerability

Description

Rig Exploit for CVE-2018-8174 As with its previous campaigns, Rig’s Seamless campaign uses malvertising.  In this case, the malvertisements have a hidden iframe that redirects victims to Rig’s landing page,  which includes an exploit for CVE-2018-8174 and shellcode.  This enables remote code execution of the shellcode obfuscated in the landing page.  After successful exploitation, a second-stage downloader is retrieved,  which appears to be a variant of SmokeLoader due to the URL.  It would then download the final payload, a Monero miner.

Readme

# Rig-Exploit-for-CVE-2018-8174
Rig Exploit for CVE-2018-8174 As with its previous campaigns, Rig’s Seamless campaign uses malvertising.  In this case, the malvertisements have a hidden iframe that redirects victims to Rig’s landing page,  which includes an exploit for CVE-2018-8174 and shellcode.  This enables remote code execution of the shellcode obfuscated in the landing page.  After successful exploitation, a second-stage downloader is retrieved,  which appears to be a variant of SmokeLoader due to the URL.  It would then download the final payload, a Monero miner.

File Snapshot

 [4.0K]  /data/pocs/b0e9be780bb44aea85c792dafb04fb2e1668bfd5
├── [  73]  IPs and Domains.txt
├── [ 581]  README.md
├── [ 497]  Related Hashes.txt
└── [1.2K]  Rig Exploit for CVE-2018-8174 SIGMA.txt

0 directories, 4 files

Remarks