Skip to content
Proof of Concept exploit for CVE-2017-8570
Branch: master
Clone or download
Latest commit a015d3a Jan 9, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information. Update readme Jan 9, 2018
calc.sct init Jan 9, 2018
example.rtf init Jan 9, 2018


This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides.


A few reasons.

  1. I wanted to see if it was possible to use the Packager.dll file-dropping trick to exploit this vulnerability.
  2. As far as I'm aware, all other public exploits for CVE-2017-8570 are actually exploiting the "Script Moniker" variant of CVE-2017-0199 and are not actually composite moniker exploits.
  3. Raise awareness of exploitation techniques used in the wild, and help defenders to detect exploitation attempts.

How to run

Simply run the script, providing an Sct file to execute, and an output name for your RTF file:

python -s calc.sct -o example.rtf
[+] RTF file written to: example.rtf


I have included a Yara rule to detect attempts to exploit this vulnerability via RTF.


You can’t perform that action at this time.