17 lines
No EOL
682 B
Text
17 lines
No EOL
682 B
Text
Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample
|
|
|
|
Running CVE-2017-8759 exploit sample.
|
|
|
|
Flow of the exploit:
|
|
|
|
Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe
|
|
|
|
To test:
|
|
|
|
Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python -m SimpleHTTPServer 8080
|
|
|
|
If all is good mspaint should run.
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/42711.zip |