## https://sploitus.com/exploit?id=B51D2DE3-BABE-5C23-9003-E98F8F8C3071
This repository contains a Proof of Concept (PoC) exploit for CVE-2017-8570, a vulnerability in Microsoft Office that allows an attacker to execute arbitrary code by embedding a malicious script in a Rich Text Format (RTF) file. The exploit uses the "Packager.dll" file-dropping trick to drop a ".sct" file into the %TEMP% directory, and then execute it using the primitive provided by the vulnerability.
The exploit is implemented in Python and consists of two main components: the "packager_composite_moniker.py" script, which generates a malicious RTF file, and the "rtf_composite_moniker.yara" rule, which detects attempts to exploit this vulnerability via RTF.
The "packager_composite_moniker.py" script takes a file as input and generates a malicious RTF file that contains a scriptlet with a malicious payload. The scriptlet is encoded in a way that makes it difficult to detect by traditional antivirus software. The script then writes the RTF file to a temporary location and executes it using the "wscript" command.
The "rtf_composite_moniker.yara" rule is a YARA rule that detects RTF files that contain a scriptlet with a malicious payload. The rule looks for specific