Skip to content
master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
Jan 9, 2018
Jan 9, 2018
Jan 9, 2018

What?

This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides.

Why?

A few reasons.

  1. I wanted to see if it was possible to use the Packager.dll file-dropping trick to exploit this vulnerability.
  2. As far as I'm aware, all other public exploits for CVE-2017-8570 are actually exploiting the "Script Moniker" variant of CVE-2017-0199 and are not actually composite moniker exploits.
  3. Raise awareness of exploitation techniques used in the wild, and help defenders to detect exploitation attempts.

How to run

Simply run the script, providing an Sct file to execute, and an output name for your RTF file:

python packager_composite_moniker.py -s calc.sct -o example.rtf
[+] RTF file written to: example.rtf

Detection

I have included a Yara rule to detect attempts to exploit this vulnerability via RTF.

References

About

Proof of Concept exploit for CVE-2017-8570

Resources

Releases

No releases published

Packages

No packages published

Languages