CVE-2014-4114
HIGH KEVMS14-060 Microsoft Windows OLE Package Manager Code Execution
Title source: metasploitExploitation Summary
CVE-2014-4114 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022.
EIP tracks 8 public exploits from researchers including Metasploit, Mike Czumak, Vlad Ovtchinikov, including a Metasploit module exploits/windows/fileformat/ms14_064_packager_python.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-4114 (MS14-060) in Microsoft Windows OLE Package Manager to achieve remote code execution via a malicious INF file embedded in a PPSX file. It generates an INF, GIF, and PPSX file, requiring a SMB share to host the payload.
Description
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."
Exploits (8)
This Metasploit module exploits CVE-2014-4114 (MS14-060) in Microsoft Windows OLE Package Manager to achieve remote code execution via a malicious INF file embedded in a PPSX file. It generates an INF, GIF, and PPSX file, requiring a SMB share to host the payload.
This Python script generates a malicious PowerPoint (PPSX) file exploiting CVE-2014-4114 (MS14-060) via OLE object manipulation. It embeds a remote SMB share reference to execute arbitrary code when the file is opened.
This Python script automates the creation of a malicious PowerPoint file (exploit.ppsx) that exploits CVE-2014-4114, a vulnerability in Microsoft Office's OLE packager. It modifies embedded OLE objects to reference a remote SMB share hosting a malicious INF and executable file, enabling remote code execution when the victim opens the file.
This Metasploit module exploits CVE-2014-4114 (Sandworm) via a crafted PPSX file containing malicious OLE objects, targeting Windows systems with Python installed. It leverages the OLE Package Manager vulnerability to achieve remote code execution by embedding Python payloads in the file.
This Metasploit module exploits CVE-2014-6352 (MS14-064) by crafting a malicious PPSX file with an embedded OLE object that executes arbitrary code when opened in vulnerable Microsoft Office versions. It leverages the 'Sandworm' vulnerability to bypass patch mitigations and achieve remote code execution.
This Python script generates a malicious OLE file to exploit CVE-2014-4114, a vulnerability in Microsoft Windows OLE that allows remote code execution. The exploit embeds a payload executable into an OLE object, which can be triggered when the file is opened in vulnerable versions of Microsoft Office.
This Metasploit module exploits CVE-2014-4114 by crafting a malicious PPSX file with embedded OLE objects that execute arbitrary Python code when opened, bypassing MS14-060. It leverages the 'Sandworm' vulnerability in Windows OLE Package Manager.
This Metasploit module exploits CVE-2014-4114 (Sandworm) by crafting a malicious PPSX file that leverages OLE object manipulation to execute arbitrary code via a malicious INF file hosted on a remote SMB share.
References (11)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H