blackmathit/2017-11882_generatorCVE-2017-11882 File Generator PoC
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
This is a PoC re-edited, from the original one made by Embedi, to generate single file .rtf with a remote command execution embedded.
python 2017-11882_Generator.py -x command_to_execute -o output_file_name
Example: python 2017-11882_Generator.py -x "cmd /c calc" -o test.rtf
For 32-bit Microsoft Office package in x86 OS: reg add "HKLM\SOFTWARE\Microsoft\Office\Common\COM Compatibility{0002CE02-0000-0000-C000-000000000046}" /v "Compatibility Flags" /t REG_DWORD /d 0x400
For 32-bit Microsoft Office package in x64 OS: reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Common\COM Compatibility{0002CE02-0000-0000-C000-000000000046}" /v "Compatibility Flags" /t REG_DWORD /d 0x400
Microsoft released a Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
