Added module for CVE-2021-40444 #15742
Conversation
bwatters-r7
added
rn-modules
| end | ||
|
|
||
| #create cab file | ||
| def create_cabfile(input_data) |
There was a problem hiding this comment.
Nice! I was afraid we'd need to use a local binary to do this....
|
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
gwillcox-r7
added
the
needs-linting
|
Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools. We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit: You can automate most of these changes with the Please update your branch after these have been made, and reach out if you have any problems. |
|
Is it possible to give hacktoberfest label for this pull? |
=> Added Deobfuscated HTML Payload => Removed Extra Author Credits => Made SRVHOST AND SRVPORT MANDATORY => generate_uri replaced with builtin get_uri
|
The |
why is it not in my metasploit? |
|
Hello @thesunRider, @bwatters-r7, @smcintyre-r7 I made a lot of modifications based on this module logic (exploit using cab file)
As this has not changed for 1 month, can I join this PR to add this?
|
|
Hey @thesunRider and @mekhalleh! Sorry this has been sitting for a bit. I've had some other things crop up as priorities, but absolutely, @mekhalleh please feel free to PR to this branch. I'm happy to check it out and work with you all on integration and landing next week, as this is going to be my priority next week again, so thanks everyone for their patience! |
|
I thought I could attach myself to this PR but obviously not. sorry in advance, this created another PR... -> #15848 |
|
It's done. I've add PR on.
|
@bwatters-r7 have you licenced your microsoft office ? This doesn't work on unlicensed version. Else must is share with me the files generated by the exploit. exemple : EDIT: And DON'T run the docx from a shared folder... copy the docx on the local disk. |
|
I'll collect the rules of use here:
|
|
Odd.... I tried a half-dozen different things, then out of frustration, I reset my VM and immediately got a session..... |
There was a problem hiding this comment.
Hi there! Sorry this took so long to get to!
I have a couple thoughts: First, there's a lot of code duplication between the auxiliary and exploit modules. The easiest solution might be to rework the exploit module so that the auxiliary module is no longer needed, but if we need to keep both, we should move the methods to a shared library based on the reusability of the code. Offhand, I think that the cab creation method could be used by others and should get located in the rex-zip library, but the others are less likely to be reused and I'm not entirely sure where those should live if we decide to keep both modules. Possibly lib/msf/core/util/?
documentation/modules/exploit/windows/fileformat/word_mshtml_rce.md
Outdated
Show resolved
Hide resolved
|
Yeah; I'm liking the idea of combining the |
|
Hrm...... let me see if I can knock out those changes in a PR..... give me a bit. |
|
Still trying to figure out the best way to toggle that HTTP server.... |
Initially, I had done only one module. Come to think of it I split this because I didn't figure out how to disable the web server. |
|
I was able to successfully do a HTTP server toggle by overwriting the exploit method: thesunRider#2 |
|
hello @thesunRider, can you merge the PR from @bwatters-r7 pls ? |
Toggle HTTP server
|
Thank you very much @thesunRider , i'm very busy again this week but i will try to finish the job:
The next commit should be the last one before merging this. |
|
Hey @thesunRider and @mekhalleh! I wanted to let you know that this is a holiday week in the US so I won't be doing much work on this until Monday, but if you are OK with all the changes suggested, I can do the cleanup, module removal, module doc change, and retest next week while I'm landing it to save some time for you both. Because I made some changes, I need to get another committer to OK them, but I can take care of that, too, and that would not happen until next week, either. If you are both OK with the changes on removing the aux module and updating the docs, I can take care of it all next week. |
|
I am having a bit of rush with my schedules, I will try to do @mekhalleh task list if time comes by Happy holidays @bwatters-r7 |
|
Yes it is a good idea @bwatters-r7, I did not dare to suggest it to you ... It's OK for me, I'll let you make the changes. As always, I am delighted to contribute to, it's a real pleasure. Thanks a lot @thesunRider 👯 And have a good holiday ;) |
|
|
||
| @proto = (datastore['SSL'] ? 'https' : 'http') | ||
| if datastore['SRVHOST'] == '0.0.0.0' | ||
| datastore['SRVHOST'] = Rex::Socket.source_address('1.2.3.4') |
There was a problem hiding this comment.
It's not necessary to pass in 1.2.3.4. The function provides a default public address already.
| end | ||
|
|
||
| def exploit | ||
| print_status("target.name = #{target.name}") |
There was a problem hiding this comment.
If we're going to print the target here, can we make it a little more descriptive so it doesn't look like debug output?
|
I've pulled a cleaner set of javascript and incorporated it, but I'm now getting an odd problem where I get code execution, but the session fails to establish. |
|
For what it is worth, I'm still working on this. I've discovered that somehow, we have managed to create a strange handler state. |
|
On at least three occasions I thought I figured this out. I've been unable to obtain results consistently, though. |
|
Huh..... OK. I think I see how I did this, now. |
Split out javascript to a file and deobfuscate it Update documentation for new targets Fix other small suggestions
Retest |
It's not currently working and Metasploit should just handle everything
Release NotesThis adds an exploit for CVE-2021-40444 which is a vulnerability that affects Microsoft Word. Successful exploitation results in code execution in the context of the user running Microsoft Word. |
This PR is for CVE-2021-40444 , module can be used for generating malicious docx files when run on vulnerable MS Word will spawn reverse shells. This was developed on demand from #15694
The exploit doesn't seem to work on pirated versions of the targeted software.
Verification
msfconsoleuse exploit/windows/fileformat/office_word_docxoptionsUpdates including sending additional files once the payload connects back will be shown as debug output
##Running the module
You can use the module like this:
Copy the payload.docx to target machine and run it, if everything goes well you should see a meterpreter poping up :-)