Microsoft Windows .NET Framework - Remote Code Execution 0day Exploit

🗓️ 13 Sep 2017 00:00:00Reported by VoulnetType

zdt🔗 0day.today👁 171 Views

Microsoft .NET Framework 0day Exploit Runnin

Reporter	Title	Published	Views	Family All 128
GithubExploit	Exploit for Code Injection in Microsoft	13 Sep 201717:10	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	14 Sep 201710:04	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	17 Sep 201722:05	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	25 Feb 202023:10	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	13 Sep 201709:50	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	13 Sep 201715:24	–	githubexploit
Gitee	Exploit for Code Injection in Microsoft	23 Jul 202011:31	–	gitee
ICS	Top 10 Routinely Exploited Vulnerabilities	12 May 202012:00	–	ics
ATTACKERKB	CVE-2017-8759	13 Sep 201700:00	–	attackerkb
BDU FSTEC	The vulnerability of the SOAP WSDL Parser module of the Microsoft .NET Framework allows a perpetrator to execute arbitrary code.	17 Oct 201700:00	–	bdu_fstec

Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample
 
Running CVE-2017-8759 exploit sample.
 
Flow of the exploit:
 
Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe
 
To test:
 
Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python -m SimpleHTTPServer 8080
 
If all is good mspaint should run.

#  0day.today [2018-03-14]  #

13 Sep 2017 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.93965