Microsoft Office and WordPad Remote Code Execution Vulnerability

PoC: CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other payload to victim without any complex configuration.

PoC: CVE-2017-0199-master

CVE-2017-0199

PoC: CVE-2017-0199-Fix

Quick and dirty fix to OLE2 executing code via .hta

PoC: CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and deliver metasploit / meterpreter / any other payload to victim without any complex configuration.

PoC: RTF-Cleaner

RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & CVE-2017-8759

PoC: CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and deliver metasploit / meterpreter payload to victim without any complex configuration.

PoC: RTF-Cleaner

RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically.

PoC: htattack

An exploit implementation for RCE in RTF & DOCs (CVE-2017-0199)

PoC: Phishing-Analysis

This repository contains a full blue-team malware analysis of a real malicious DOCX exploiting CVE-2017-0199. The lab includes sandbox execution, network forensics, IOC extraction, MITRE ATT&CK mapping, dropped files review, and detection rules. Evidence screenshots are included inside the evidence folder for professional documentation.

PoC: PoC-CVE-2017-0199

Exploit toolkit for vulnerability RCE Microsoft RTF

PoC: XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant

CVE-2017-0199 XLS --> HTA --> VBS --> STEGANOGRAPHY --> DBATLOADER/GULOADER STYLE MALWARE

PoC: CVE-2017-0199

Python3 toolkit update

PoC: CVE-2017-0199-reprofuction

CVE-2017-0199复现

PoC: CVE-2017-0199

A python script/generator, for generating and exploiting Microsoft vulnerability

PoC: Cve-2017-0199-

Cve-2017-0199