Skip to content

rxwx/CVE-2018-0802

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
January 13, 2018 15:34
February 28, 2018 12:32
January 13, 2018 15:21

CVE-2018-0802

packager_exec CVE-2018-0802

This repo contains a Proof of Concept exploit for CVE-2018-0802. To get round the limited command length allowed, the exploit uses the Packager OLE object to drop an embedded payload into the %TMP% directory, and then executes the file using a short command via a WinExec call, such as: cmd.exe /c%TMP%\file.exe.

Usage

packager_exec_CVE-2018-0802.py -e executable_path -o output_file_name

Add the -d option to exploit both CVE-2017-11882 and CVE-2018-0802 in the same document.

Detection

I've added a Yara rule to detect this specific variant of the exploit as used itw. Please note that this can be easily bypassed and may need tweaking. Happy to take PR's for better ones ;)

Greetz

This exploit is based heavily on the prior work already done by Embedi on CVE-2017-11882. I take no credit for the great work already achieved by those mentioned here.

Kudos also goes out to the many discoverers:

  • bee13oy of Qihoo 360 Vulcan Team
  • zhouat of Qihoo 360 Vulcan Team
  • Liang Yin of Tencent PC Manager
  • Luka Treiber of 0patch Team - ACROS Security
  • Netanel Ben Simon and Omer Gull of Check Point Software Technologies
  • Yang Kang, Ding Maoyin and Song Shenlei of Qihoo 360 Core Security (@360CoreSec)
  • Yuki Chen of Qihoo 360 Vulcan Team
  • Zhiyuan Zheng

Sample exploit for CVE-2018-0802 (starting calc.exe as payload)

example folder holds an .rtf file which exploits CVE-2018-0802 vulnerability and runs calculator in the system.

About

PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages