CVE-2021-40444

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

CVE-2022-30190

MS-MSDT Follina CVE-2022-30190 PoC Microsoft Office Word 원격 코드 실행 취약점을 악용하는 악성 docx 생성기 이 스크립트는 LockedByte의 CVE-2021-40444 PoC와 Tothi의 writeup을 기반으로 제작되었습니다. 사용법 먼저 backup.html을 수정하고 powershell 페이로드를 교체하세요. 현재는 IEX'calc.exe'를 사용하여 calc.exe만 실행합니다. python3 exploit.py generate http:// 악성 docx를...

CVE-2021-40444

완전 무장된 CVE-2021-40444 CVE-2021-40444 Microsoft Office Word 원격 코드 실행를 악용하는 악성 docx 생성기, 임의의 DLL 파일과 함께 작동합니다. 2022-05-31 업데이트 - CVE-2022-30190 - Follina 이제 생성기는 "Follina" 공격ms-msdt 활용을 악용하는 데 필요한 문서도 생성할 수 있습니다. 배경 이미 많은 PoC가 인터넷에 돌아다니고 있지만, 이 취약점을 무장화하는 데 도전해보기로 했습니다. 제가 찾은 자료들은 공유할 가치가 있는 중요한 정보...

CVE-2021-40444-exp

CVE-2021-40444 PoC 악성 docx 생성기로 CVE-2021-40444Microsoft Office Word 원격 코드 실행를 악용합니다. 이 스크립트는 실제 환경에서 사용된 샘플 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52docx 파일에 대한 리버스 엔지니어링을 기반으로 제작되었습니다. 먼저 lcab를 설치해야 합니다sudo apt-get install lcab 수동 재현 단계는 REPRODUCE.md를 확인하세요. 생성된 cab이 작동하지...

CVE-2021-40444

CVE-2021-40444 PoC CVE-2021-40444를 악용하는 악성 docx 생성기 Microsoft Office Word 원격 코드 실행 이 스크립트는 실제 환경에서 사용된 샘플938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52, docx 파일에 대한 리버스 엔지니어링을 기반으로 작성되었습니다. 먼저 lcab을 설치해야 합니다 sudo apt-get install lcab 수동 재현 단계는 REPRODUCE.md를 확인하세요 생성된 cab이 작동하지 않...

CVE-2021-40444

완전 무기화된 CVE-2021-40444 CVE-2021-40444Microsoft Office Word 원격 코드 실행를 악용하기 위한 악성 docx 생성기로, 임의의 DLL 파일과 함께 작동합니다. 배경 인터넷에 이미 많은 PoC가 있지만, 공유할 가치가 있는 유용한 정보가 부족하다고 느꼈고, Microsoft가 이미 이 취약점에 대한 패치를 출시했다는 점을 고려하여 이 취약점을 무기화하는 작업에 도전해 보기로 했다. 지금까지 완전히 작동하는 생성기를 만들기 위해 본 유일한 유용한 자료는 다음과 같습니다: Ret2Pwn의...

RCE-CVE-2017-0199-detection-analysis

🛡️ BankPaymAdviceVend.Report.docx CVE-2017-0199 – Full Blue Team Sandbox Analysis- My approach to analayze that malware that leadsto critical security vulnerability in Microsoft Office. Advanced Malware Detonation • Exploit Behaviour • IOCs • Detection Engineering. 🎯 1. Executive Summary This...

EUVD-2024-52835

Malicious code in bioql PyPI...

Microsoft Excel LTSC 2024 - Remote Code Execution (RCE)

Titles: Microsoft Excel LTSC 2024 - Remote Code Execution RCE Author: nu11secur1ty Date: 06/16/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27751 CVE-2025-47957 Versions: Microsoft...

Microsoft Excel Use After Free - Local Code Execution

Titles: Microsoft Excel Use After Free - Local Code Execution Author: nu11secur1ty Date: 06/09/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27751 Versions: MS Excel 2016, MS Office...

📄 Microsoft Excel Remote Code Execution

Microsoft Excel appears to suffer from a remote code execution vulnerability via a malicious macro. Titles: Microsoft Excel Local Code Execution Vulnerability Author: nu11secur1ty Date: 06/09/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference:...

CVE-2020-11536

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server...

CVE-2020-11534

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary such as curl or wget and remotely execute code on a victim's server...

CVE-2024-55652 PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters

PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the...

Exploit for CVE-2022-30190

CVE-2022-30190 Microsoft Office Word Rce 复现CVE-2022-30190...

Exploit for Path Traversal in Microsoft

This repository is an exploit module for CVE-2021-40444, a remote code execution vulnerability in Microsoft Office Word. The exploit is a malicious docx generator that creates a document that, when opened, will execute a malicious DLL file. The exploit is based on some reverse engineering over a...

CVE-2020-11536: Improper Input Validation

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...