CVE-2015-6128

This exploit demonstrates a DLL planting attack in Microsoft Office via a crafted OLE object. By modifying the CLSID in a document, an attacker can force the loading of a malicious DLL (elsext.dll) from the current directory, achieving arbitrary code execution.

This Metasploit module exploits multiple DLL side-loading vulnerabilities in various COM components by embedding a malicious OLE object in a PPSX file. When opened, the file triggers the loading of a malicious DLL from the current directory, leading to arbitrary code execution.