Microsoft Windows .NET Framework - Remote Code Execution

EDB-ID: 42711
Author: Voulnet
Published: 2017-09-13
CVE: CVE-2017-8759
Type: Remote
Platform: Windows
Aliases: N/A
Tags: N/A
Vulnerable App: N/A

Running CVE-2017-8759 exploit sample.

Flow of the exploit:

Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe

To test:

Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python -m SimpleHTTPServer 8080

If all is good mspaint should run.

Proof of Concept:

Related Posts