https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY

Exploit for the CVE-2023-23397
https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY

Last synced: about 2 months ago
JSON representation

Exploit for the CVE-2023-23397

• Host: GitHub
• URL: https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY
• Owner: sqrtZeroKnowledge
• Created: 2023-03-15T17:03:38.000Z (almost 2 years ago)
• Default Branch: main
• Last Pushed: 2023-03-15T17:53:53.000Z (almost 2 years ago)
• Last Synced: 2024-08-05T17:25:56.688Z (5 months ago)
• Language: C#
• Size: 11.5 MB
• Stars: 160
• Watchers: 2
• Forks: 45
• Open Issues: 2
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY - Exploit for the CVE-2023-23397 (C# #)

README

        
# CVE-2023-23397_EXPLOIT_0DAY

Exploit for the CVE-2023-23397

Credit to domchell

EML/MSG Checker for the exploit: 

    #!/usr/bin/env python3

    

    from extract_msg import AppointmentMeeting

    from ..helpers import Status

    from ..task import Task

    from ..report import Report

    from .base import BaseWorker

    class OutlookMSG(BaseWorker):

    def analyse(self, task: Task, report: Report, manual_trigger: bool=False):

    print(task.file.msg_data)

    if not task.file.msg_data or not isinstance(task.file.msg_data, AppointmentMeeting):

    report.status = Status.NOTAPPLICABLE

    return

    self.logger.debug(f'analysing AppontmentMeeting in {task.file.path}...')

    if task.file.msg_data.reminderFileParameter is not None:

    report.status = Status.ALERT

    # suspicious for cve-2023-23397: https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/

    report.add_details('CVE-2023-23397', f'A parameter used to exploit this vulnerability is present in the mail: "{task.file.msg_data.reminderFileParameter}"')

[Based on Pandora Framework](https://github.com/pandora-analysis/pandora/blob/0dd6b01956b0501c28e4a7c1128298dcd6a499b8/pandora/workers/outlookmsg.py)