header-logo
Suggest Exploit
vendor:
Microsoft Office
by:
Voulnet
7,8
CVSS
HIGH
CVE-2017-8759
20
CWE
Product Name: Microsoft Office
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: CVE-2017-8759
CPE: N/A
Metasploit: https://www.rapid7.com/db/vulnerabilities/msft-cve-2017-8759/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2017

Running CVE-2017-8759 exploit sample

The exploit involves a Word macro running in the Doc1.doc file which downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe

Mitigation:

Disable macros in Microsoft Office, use a web application firewall, and ensure that all web applications are patched and up to date.
Source

Exploit-DB raw data:

Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Running CVE-2017-8759 exploit sample.

Flow of the exploit:

Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe

To test:

Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python -m SimpleHTTPServer 8080

If all is good mspaint should run.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42711.zip

Navigation

Suggest Exploit

Services By CQR