rip1s / cve-2017-11882 Goto Github PK

Hi unamer,

I wonder if i can use my own doc files, you know with customized content. I found that if i use your script to create a doc file, then i input some words in it, it can't work any more. any help will appreciate.

Hi
i have question
how can change the exe or other payload formats to ./sc.exe for example
exe to ./exe
or b.dll to ./b.dll
Thanks
regards

Hi unamer, thanks for reading this issue.
Test environment:

windows 7 sp1 pro edition x64
Office pro plus 2016 x86 and x64

When I use command
python CVE-2017-11882.py -c calc.exe -o test_calc.rtf
to generate rtf and test the vul, it does work.
However, when I use
python CVE-2017-11882.py -c calc.exe -o test_cmd.rtf
to test, cmd.exe doesn't open.

test_calc.rtf:
https://mega.nz/#!xIcSyIIQ!fqBJJe6f-ts9RN9QE2TM3ATYhKk_qz1ofnIoFl8NGxk
test_cmd.rtf:
https://mega.nz/#!xNVU3aSI!gBpiI-kXRmyGwk9ulyPn1NnbugiYP03zH3uJYpWXC3E
eqnedt32.exe:
https://mega.nz/#!xNVU3aSI!gBpiI-kXRmyGwk9ulyPn1NnbugiYP03zH3uJYpWXC3E

Expect your reply!
Thx!

im using custom shellcode with flag "-t", Equation Editor Crashes but your staged shellcode doesn't invokes
my shellcode i used while generating doc
command : 2.py -t 0 -c sc.txt -o sc.doc
generated doc : http://s000.tinyupload.com/?file_id=51767115386029640308

Hi unamer
Thank you for seeing this issue。

test env：

OS: Windows2008 R2
Office：Microsoft Office Professional Plus 2010

generate vuln.rtf

python CVE-2017-11882.py -c "cmd.exe /c ipconfig >c:\windows\temp\1.txt" -o vuln.rtf

test is failed after open vuln.rtf ，no c:\windows\temp\1.txt

but i test https://github.com/Ridter/CVE-2017-11882/blob/master/Command43b_CVE-2017-11882.py is ok。

expecting your reply!

Thanks regards