CVE-2015-6132

This repository provides a proof-of-concept for CVE-2015-6132, a Microsoft Office / COM Object DLL Planting vulnerability. The PoC involves an RTF file and a malicious DLL (mqrt.dll) that executes arbitrary code (e.g., launching calc.exe) when placed in the same directory.

This exploit demonstrates a DLL planting attack in Microsoft Office 2010/2013 by embedding a crafted OLE object that triggers a delay-loaded DLL (mqrt.dll) to be loaded from the current directory, leading to arbitrary code execution.

This Metasploit module exploits multiple DLL side-loading vulnerabilities in various COM components by embedding a malicious OLE object in a crafted PPSX file. When opened, the file triggers the loading of a malicious DLL from the current directory, leading to arbitrary code execution.