Microsoft Windows .NET Framework - Remote Code Execution

 Running CVE-2017-8759 exploit sample. 

 Flow of the exploit: 

 Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe 

 To test: 

 Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python -m SimpleHTTPServer 8080 

 If all is good mspaint should run. 


 Proof of Concept: 
 https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42711.zip