exploitdb
WORKING POC
by embedi · textremotewindows
https://www.exploit-db.com/exploits/43163
This PoC exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor, to trigger command execution via a crafted RTF file. It leverages WebDav to execute arbitrary binaries from a remote attacker-controlled server.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable Microsoft Office installation · Network access to attacker-controlled WebDav server
nomisec
WORKING POC
538 stars
by Ridter · client-side
https://github.com/Ridter/CVE-2017-11882
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers remote code execution when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
nomisec
WORKING POC
496 stars
by embedi · client-side
https://github.com/embedi/CVE-2017-11882
This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via a WebDAV server to bypass command length limitations.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable Microsoft Office installation · Network access to a WebDAV server controlled by the attacker
nomisec
WORKING POC
331 stars
by rip1s · local
https://github.com/rip1s/CVE-2017-11882
This is a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
nomisec
WORKING POC
272 stars
by rxwx · client-side
https://github.com/rxwx/CVE-2018-0802
This repository contains a Python-based exploit for CVE-2018-0802, which leverages the Packager OLE object to drop and execute a payload via an RTF file. The exploit can also chain CVE-2017-11882 for additional impact.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open malicious RTF file
nomisec
WORKING POC
167 stars
by Ridter · client-side
https://github.com/Ridter/RTF_11882_0802
This repository contains a Python script that generates malicious RTF files exploiting CVE-2017-11882 and CVE-2018-0802 in Microsoft Office. The exploit leverages a vulnerability in the Equation Editor to achieve remote code execution.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Python environment · Target system with vulnerable Microsoft Office installation
nomisec
WORKING POC
97 stars
by 0x09AL · client-side
https://github.com/0x09AL/CVE-2017-11882-metasploit
This is a Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.
Classification
Working Poc 95%
Target:
Microsoft Office Word (vulnerable versions)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office Word · User interaction to open the malicious RTF file
nomisec
WORKING POC
44 stars
by starnightcyber · client-side
https://github.com/starnightcyber/CVE-2017-11882
This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
nomisec
WORKING POC
35 stars
by BlackMathIT · client-side
https://github.com/BlackMathIT/2017-11882_Generator
This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
nomisec
WORKING POC
11 stars
by likekabin · client-side
https://github.com/likekabin/CVE-2018-0802_CVE-2017-11882
This repository contains a Python script that generates malicious RTF files exploiting CVE-2017-11882 and CVE-2018-0802 in Microsoft Office Equation Editor. The script embeds arbitrary commands into the RTF file, which execute upon opening in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office with unpatched Equation Editor · User interaction to open the malicious RTF file
nomisec
WORKING POC
6 stars
by Retr0-code · client-side
https://github.com/Retr0-code/SignHere
This repository contains a Python-based exploit for CVE-2017-11882, a Microsoft Office memory corruption vulnerability. It generates malicious RTF documents with embedded commands to execute payloads via VBScript or PowerShell, leveraging the Equation Editor flaw.
Classification
Working Poc 95%
Target:
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2016
No auth needed
Prerequisites:
Python 3 · Network access to host payloads
nomisec
WORKING POC
5 stars
by littlebin404 · client-side
https://github.com/littlebin404/CVE-2017-11882
This repository contains a working proof-of-concept exploit for CVE-2017-11882, a buffer overflow vulnerability in Microsoft Office's Equation Editor. The exploit generates malicious RTF files that execute arbitrary commands when opened, affecting Office versions 2003 to 2016.
Classification
Working Poc 95%
Target:
Microsoft Office 2003-2016
No auth needed
Prerequisites:
Victim must open the malicious RTF file
nomisec
STUB
3 stars
by zhouat · poc
https://github.com/zhouat/cve-2017-11882
The repository contains only a README.md file with a CVE identifier and no exploit code or technical details. It appears to be a placeholder or stub for CVE-2017-11882.
Target:
Microsoft Office (CVE-2017-11882)
No auth needed
Prerequisites:
none
nomisec
WORKING POC
2 stars
by ekgg · poc
https://github.com/ekgg/Overflow-Demo-CVE-2017-11882
This repository contains a proof-of-concept for CVE-2017-11882, demonstrating a stack-based buffer overflow vulnerability. The code includes a GUI and a console application to trigger the overflow by loading a maliciously crafted file.
Classification
Working Poc 95%
Target:
Microsoft Office Equation Editor (EQNEDT32.EXE)
No auth needed
Prerequisites:
A maliciously crafted file to trigger the buffer overflow
nomisec
STUB
2 stars
by ChaitanyaHaritash · poc
https://github.com/ChaitanyaHaritash/CVE-2017-11882
This repository is a stub that redirects to another repository for the actual exploit code. It contains no functional exploit code or technical details.
Target:
Microsoft Office (CVE-2017-11882)
No auth needed
Prerequisites:
none
nomisec
WORKING POC
2 stars
by Shadowshusky · client-side
https://github.com/Shadowshusky/CVE-2017-11882-
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that can execute arbitrary commands when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
nomisec
WRITEUP
1 stars
by Abdibimantara · poc
https://github.com/Abdibimantara/Maldoc-Analysis
This repository contains a writeup discussing malware samples exploiting CVE-2017-11882 and CVE-2018-0802, specifically targeting Microsoft Office files. No exploit code is provided, only a description of the malware and its association with the vulnerabilities.
Classification
Writeup 90%
Target:
Microsoft Office (unspecified version)
No auth needed
Prerequisites:
Malicious Office document
nomisec
WORKING POC
1 stars
by Sunqiz · client-side
https://github.com/Sunqiz/CVE-2017-11882-reproduction
This repository contains a Python-based proof-of-concept exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
nomisec
WORKING POC
1 stars
by tzwlhack · remote
https://github.com/tzwlhack/CVE-2017-11882
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
gitlab
WORKING POC
by Gaojianli · poc
https://gitlab.com/Gaojianli/CVE-2017-11882
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
nomisec
WORKING POC
by imkidz0 · client-side
https://github.com/imkidz0/CVE-2017-11882
This repository contains a Python-based PoC for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that, when opened, executes arbitrary commands via a crafted OLE object.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Victim must open the malicious RTF file in a vulnerable version of Microsoft Office
nomisec
SCANNER
by xdrake1010 · poc
https://github.com/xdrake1010/CVE-2017-11882-Preventer
This repository contains a Chrome extension designed to detect DOCX files exploiting CVE-2017-11882 by analyzing embedded Equation Editor objects and suspicious font name lengths. It uses JSZip to parse DOCX files as ZIP archives and checks for malicious indicators.
Classification
Scanner 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Chrome browser · DOCX file download
nomisec
WORKING POC
by lisinan988 · client-side
https://github.com/lisinan988/CVE-2017-11882-exp
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
nomisec
WORKING POC
by chanbin · client-side
https://github.com/chanbin/CVE-2017-11882
This Python script generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit embeds a crafted OLE object to achieve remote code execution when the RTF is opened.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Victim opens the malicious RTF file
nomisec
WORKING POC
by j0lama · remote
https://github.com/j0lama/CVE-2017-11882
This is a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
nomisec
WORKING POC
by likekabin · poc
https://github.com/likekabin/CVE-2017-11882
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that, when opened, executes arbitrary commands (up to 109 bytes) via a crafted OLE object.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
Victim must open the malicious RTF file in a vulnerable version of Microsoft Office
nomisec
STUB
by CSC-pentest · poc
https://github.com/CSC-pentest/cve-2017-11882
The repository contains only a README.md file with minimal content, lacking any exploit code or technical details for CVE-2017-11882. No functional PoC, scanner, or writeup is present.
Target:
Microsoft Office (unspecified version)
No auth needed
nomisec
WORKING POC
by Grey-Li · remote
https://github.com/Grey-Li/CVE-2017-11882
This is a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit embeds a crafted OLE object to achieve remote code execution.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Victim opens the malicious RTF file in a vulnerable version of Microsoft Office
nomisec
WRITEUP
by HZachev · poc
https://github.com/HZachev/ABC
The repository contains a README.md file referencing CVE-2017-11882 with links to Invoke-Mimikatz and a calc.exe payload, but lacks actual exploit code or technical details. It appears to be a placeholder or incomplete writeup.
Classification
Writeup 30%
Target:
Microsoft Office (unspecified version)
No auth needed
Prerequisites:
none specified
metasploit
WORKING POC
MANUAL
by mumbai, embedi · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_ms17_11882.rb
This Metasploit module exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor that allows arbitrary code execution via maliciously crafted RTF files. The exploit generates an RTF file with an embedded OLE object to trigger the vulnerability.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Victim opens the malicious RTF file
patchapalooza
WORKING POC
by j4_son · poc
https://gitee.com/j4_son/CVE-2017-11882
This repository contains functional exploit code for CVE-2017-11882, a buffer overflow vulnerability in Microsoft Office's Equation Editor. The exploit generates malicious RTF files that execute arbitrary commands when opened, targeting Office versions 2003-2016.
Classification
Working Poc 95%
Target:
Microsoft Office (2003-2016)
No auth needed
Prerequisites:
victim opens malicious RTF file
patchapalooza
WORKING POC
by mirrors_embedi · poc
https://gitee.com/mirrors_embedi/CVE-2017-11882
This repository contains a functional Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via WebClient service and a WebDAV server to bypass command length limitations.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable Microsoft Office installation · WebDAV server controlled by attacker
patchapalooza
WORKING POC
by mirrors_unamer · poc
https://gitee.com/mirrors_unamer/CVE-2017-11882
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE component. The exploit generates malicious RTF files that execute arbitrary shellcode or commands via a stack-based buffer overflow, with support for process injection to avoid crashing the target application.
Classification
Working Poc 95%
Target:
Microsoft Office (EQNEDT32.EXE)
No auth needed
Prerequisites:
vulnerable Microsoft Office installation · ability to deliver malicious RTF file to target
patchapalooza
WORKING POC
by csharphpython · poc
https://gitee.com/csharphpython/CVE-2017-11882
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
victim opens malicious RTF file
patchapalooza
WORKING POC
by adai2022 · poc
https://gitee.com/adai2022/CVE-2017-11882
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE. The exploit generates a malicious RTF file that can execute arbitrary commands or shellcode, with support for process injection to avoid crashing the target application.
Classification
Working Poc 95%
Target:
Microsoft Office (EQNEDT32.EXE)
No auth needed
Prerequisites:
vulnerable Microsoft Office installation · ability to deliver malicious RTF file to target
patchapalooza
WORKING POC
by zhangbo123321 · poc
https://gitee.com/zhangbo123321/CVE-2017-11882-metasploit
This is a functional Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.
Classification
Working Poc 95%
Target:
Microsoft Office Word (with vulnerable Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office Word · User interaction to open the malicious RTF file
patchapalooza
WORKING POC
by aston_mation · poc
https://gitee.com/aston_mation/CVE-2017-11882
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The scripts generate malicious RTF files that execute arbitrary commands when opened.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
victim opens malicious RTF file
patchapalooza
WORKING POC
by putiji · poc
https://gitee.com/putiji/CVE-2017-11882-17k
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE. The exploit generates a malicious RTF file that triggers remote code execution via a crafted payload, with support for both command execution and shellcode injection.
Classification
Working Poc 95%
Target:
Microsoft Office (EQNEDT32.EXE)
No auth needed
Prerequisites:
vulnerable Microsoft Office installation · user interaction to open malicious RTF file
patchapalooza
WORKING POC
by putiji · poc
https://gitee.com/putiji/CVE-2017-11882
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands (e.g., calc.exe) when opened in vulnerable versions of Microsoft Office.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office · User interaction to open the malicious RTF file
patchapalooza
WORKING POC
by wu_ze_jun · poc
https://gitee.com/wu_ze_jun/CVE-2017-11882
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
victim opens malicious RTF file
patchapalooza
WORKING POC
by xiaolouuu · poc
https://gitee.com/xiaolouuu/CVE-2017-11882
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
victim opens malicious RTF file
patchapalooza
WORKING POC
by alessio_ · local
https://gitlab.com/alessio_/CVE-2017-11882
This repository contains a functional Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via WebClient service and a WebDAV server to bypass command length limitations.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor) <= 2017
No auth needed
Prerequisites:
WebDAV server controlled by attacker · Victim opens malicious RTF file
patchapalooza
WORKING POC
by chenM1020 · poc
https://gitee.com/chenM1020/CVE-2017-11882
This repository contains functional exploit code for CVE-2017-11882, a Microsoft Office memory corruption vulnerability. The provided Python scripts generate malicious RTF files that execute arbitrary commands via crafted OLE objects.
Classification
Working Poc 95%
Target:
Microsoft Office (Equation Editor)
No auth needed
Prerequisites:
victim opens malicious RTF file
patchapalooza
WORKING POC
by chenM1020 · poc
https://gitee.com/chenM1020/CVE-2017-11882-metasploit
This is a functional Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.
Classification
Working Poc 95%
Target:
Microsoft Office Word (with vulnerable Equation Editor)
No auth needed
Prerequisites:
Vulnerable version of Microsoft Office Word · User interaction to open the malicious RTF file