CVE-2017-11882
HIGH KEV RANSOMWAREMicrosoft Office CVE-2017-11882
Title source: metasploitExploitation Summary
CVE-2017-11882 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.
EIP tracks 51 public exploits from researchers including embedi, Ridter, rip1s, including a Metasploit module exploits/windows/fileformat/office_ms17_11882.
AI-analyzed exploit summary This PoC exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor, to trigger command execution via a crafted RTF file. It leverages WebDav to execute arbitrary binaries from a remote attacker-controlled server.
Description
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
Exploits (51)
This PoC exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor, to trigger command execution via a crafted RTF file. It leverages WebDav to execute arbitrary binaries from a remote attacker-controlled server.
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers remote code execution when opened in vulnerable versions of Microsoft Office.
This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via a WebDAV server to bypass command length limitations.
This is a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
This repository contains a Python-based exploit for CVE-2018-0802, which leverages the Packager OLE object to drop and execute a payload via an RTF file. The exploit can also chain CVE-2017-11882 for additional impact.
This repository contains a Python script that generates malicious RTF files exploiting CVE-2017-11882 and CVE-2018-0802 in Microsoft Office. The exploit leverages a vulnerability in the Equation Editor to achieve remote code execution.
This is a Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.
This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.
This repository contains a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.
This repository contains a Python script that generates malicious RTF files exploiting CVE-2017-11882 and CVE-2018-0802 in Microsoft Office Equation Editor. The script embeds arbitrary commands into the RTF file, which execute upon opening in vulnerable versions of Microsoft Office.
This repository contains a Python-based exploit for CVE-2017-11882, a Microsoft Office memory corruption vulnerability. It generates malicious RTF documents with embedded commands to execute payloads via VBScript or PowerShell, leveraging the Equation Editor flaw.
This repository contains a working proof-of-concept exploit for CVE-2017-11882, a buffer overflow vulnerability in Microsoft Office's Equation Editor. The exploit generates malicious RTF files that execute arbitrary commands when opened, affecting Office versions 2003 to 2016.
The repository contains only a README.md file with a CVE identifier and no exploit code or technical details. It appears to be a placeholder or stub for CVE-2017-11882.
This repository contains a proof-of-concept for CVE-2017-11882, demonstrating a stack-based buffer overflow vulnerability. The code includes a GUI and a console application to trigger the overflow by loading a maliciously crafted file.
This repository is a stub that redirects to another repository for the actual exploit code. It contains no functional exploit code or technical details.
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that can execute arbitrary commands when opened in vulnerable versions of Microsoft Office.
This repository contains a writeup discussing malware samples exploiting CVE-2017-11882 and CVE-2018-0802, specifically targeting Microsoft Office files. No exploit code is provided, only a description of the malware and its association with the vulnerabilities.
This repository contains a Python-based proof-of-concept exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
This repository contains a functional kernel-mode driver designed to block the exploitation of CVE-2017-11882 by monitoring process creation events and denying child processes spawned by 'eqnedt32.exe'. The driver uses a cancel-safe queue (CSQ) for IRP handling and a process notification callback to intercept and block malicious process trees.
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
This repository contains a Python-based PoC for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that, when opened, executes arbitrary commands via a crafted OLE object.
This repository contains a Chrome extension designed to detect DOCX files exploiting CVE-2017-11882 by analyzing embedded Equation Editor objects and suspicious font name lengths. It uses JSZip to parse DOCX files as ZIP archives and checks for malicious indicators.
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that triggers arbitrary code execution when opened in vulnerable versions of Microsoft Office.
This Python script generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit embeds a crafted OLE object to achieve remote code execution when the RTF is opened.
This is a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit leverages a crafted OLE object to achieve remote code execution.
This repository contains a Python-based exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit generates a malicious RTF file that, when opened, executes arbitrary commands (up to 109 bytes) via a crafted OLE object.
The repository contains only a README.md file with minimal content, lacking any exploit code or technical details for CVE-2017-11882. No functional PoC, scanner, or writeup is present.
This is a Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit embeds a crafted OLE object to achieve remote code execution.
The repository contains a README.md file referencing CVE-2017-11882 with links to Invoke-Mimikatz and a calc.exe payload, but lacks actual exploit code or technical details. It appears to be a placeholder or incomplete writeup.
This Metasploit module exploits CVE-2017-11882, a vulnerability in Microsoft Office's Equation Editor that allows arbitrary code execution via maliciously crafted RTF files. The exploit generates an RTF file with an embedded OLE object to trigger the vulnerability.
This repository contains functional exploit code for CVE-2017-11882, a buffer overflow vulnerability in Microsoft Office's Equation Editor. The exploit generates malicious RTF files that execute arbitrary commands when opened, targeting Office versions 2003-2016.
This repository contains a functional Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via WebClient service and a WebDAV server to bypass command length limitations.
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE component. The exploit generates malicious RTF files that execute arbitrary shellcode or commands via a stack-based buffer overflow, with support for process injection to avoid crashing the target application.
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE. The exploit generates a malicious RTF file that can execute arbitrary commands or shellcode, with support for process injection to avoid crashing the target application.
This is a functional Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The scripts generate malicious RTF files that execute arbitrary commands when opened.
This repository contains a functional exploit for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's EQNEDT32.EXE. The exploit generates a malicious RTF file that triggers remote code execution via a crafted payload, with support for both command execution and shellcode injection.
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands (e.g., calc.exe) when opened in vulnerable versions of Microsoft Office.
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.
This repository contains functional exploit code for CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The PoC generates malicious RTF files that execute arbitrary commands when opened.
This repository contains a functional Python script that generates a malicious RTF file exploiting CVE-2017-11882, a memory corruption vulnerability in Microsoft Office's Equation Editor. The exploit triggers command execution via WebClient service and a WebDAV server to bypass command length limitations.
This repository contains functional exploit code for CVE-2017-11882, a Microsoft Office memory corruption vulnerability. The provided Python scripts generate malicious RTF files that execute arbitrary commands via crafted OLE objects.
This is a functional Metasploit module that exploits CVE-2017-11882, a vulnerability in Microsoft Office Word's Equation Editor. It generates a malicious RTF file that, when opened, executes arbitrary code via mshta.exe.
References (15)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H