Skip to content
Proof of Concept exploit for CVE-2017-8570
Branch: master
Clone or download
Latest commit a015d3a Jan 9, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
Readme.md Update readme Jan 9, 2018
calc.sct init Jan 9, 2018
example.rtf init Jan 9, 2018
packager_composite_moniker.py
rtf_composite_moniker.yara

Readme.md

What?

This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides.

Why?

A few reasons.

  1. I wanted to see if it was possible to use the Packager.dll file-dropping trick to exploit this vulnerability.
  2. As far as I'm aware, all other public exploits for CVE-2017-8570 are actually exploiting the "Script Moniker" variant of CVE-2017-0199 and are not actually composite moniker exploits.
  3. Raise awareness of exploitation techniques used in the wild, and help defenders to detect exploitation attempts.

How to run

Simply run the script, providing an Sct file to execute, and an output name for your RTF file:

python packager_composite_moniker.py -s calc.sct -o example.rtf
[+] RTF file written to: example.rtf

Detection

I have included a Yara rule to detect attempts to exploit this vulnerability via RTF.

References

You can’t perform that action at this time.