Exploit-DB #52356
Description: Microsoft Outlook - Remote Code Execution (RCE)
Type: remote
Platform: windows
Date: 2025-07-08
Author: nu11secur1ty

Exploit:
# Titles: Microsoft Outlook - Remote Code Execution (RCE)
# Author: nu11secur1ty
# Date: 07/06/2025
# Vendor: Microsoft
# Software: https://www.microsoft.com/en-us/microsoft-365/outlook/log-in
# Reference:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47176 >
https://www.cloudflare.com/learning/security/what-is-remote-code-execution/
# CVE-2025-47176

## Description
This proof-of-concept (PoC) demonstrates the CVE-2025-47176 vulnerability
simulation. It injects a crafted mail item into Outlook containing a
malicious sync path that triggers an action during scanning.

**IMPORTANT:**
This PoC simulates the vulnerable Outlook path parsing and triggers a
**system restart** when the malicious path is detected.

---
## Additional Testing with malicious.prf

You can also test this PoC by importing a crafted Outlook Profile File
(`malicious.prf`):

1. Place `malicious.prf` in the same folder as `PoC.py`.
2. Run Outlook with the import command:

   ```powershell
   & "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
/importprf malicious.prf


## Usage

1. Ensure you have Outlook installed and configured on your Windows machine.
2. Run the PoC script with Python 3.x (requires `pywin32` package):
   ```powershell
   pip install pywin32
   python PoC.py
   ```
3. The script will:
   - Inject a mail item with the malicious sync path.
   - Wait 10 seconds for Outlook to process the mail.
   - Scan Inbox and Drafts folders.
   - Upon detection, normalize the path and trigger a system restart
(`shutdown /r /t 5`).

---

## Warning

- This script **will restart your computer** after 5 seconds once the
payload is triggered.
- Save all work before running.
- Test only in a controlled or virtualized environment.
- Do **NOT** run on production or important systems.

---

## Files

- `PoC.py` - The Python proof-of-concept script.
- `README.md` - This file.

---

## License

This PoC is provided for educational and research purposes only.

Use responsibly and ethically.


# Video:
[href](https://www.youtube.com/watch?v=nac3kUe_d1c)

# Source:
[href](
https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-47176)

# Buy me a coffee if you are not ashamed:
[href](https://www.paypal.com/donate/?hosted_button_id=ZPQZT5XMC5RFY)

# Time spent:
03:35:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


На нд, 6.07.2025 г. в 10:34 nu11 secur1ty <nu11secur1typentest@gmail.com>
написа:

> # Titles: Microsoft Outlook Remote Code Execution Vulnerability - ACE
> # Author: nu11secur1ty
> # Date: 07/06/2025
> # Vendor: Microsoft
> # Software: https://www.microsoft.com/en-us/microsoft-365/outlook/log-in
> # Reference:
> https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47176 >
> https://www.cloudflare.com/learning/security/what-is-remote-code-execution/
> # CVE-2025-47176
>
> ## Description
> This proof-of-concept (PoC) demonstrates the CVE-2025-47176 vulnerability
> simulation. It injects a crafted mail item into Outlook containing a
> malicious sync path that triggers an action during scanning.
>
> **IMPORTANT:**
> This PoC simulates the vulnerable Outlook path parsing and triggers a
> **system restart** when the malicious path is detected.
>
> ---
> ## Additional Testing with malicious.prf
>
> You can also test this PoC by importing a crafted Outlook Profile File
> (`malicious.prf`):
>
> 1. Place `malicious.prf` in the same folder as `PoC.py`.
> 2. Run Outlook with the import command:
>
>    ```powershell
>    & "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
> /importprf malicious.prf
>
>
> ## Usage
>
> 1. Ensure you have Outlook installed and configured on your Windows
> machine.
> 2. Run the PoC script with Python 3.x (requires `pywin32` package):
>    ```powershell
>    pip install pywin32
>    python PoC.py
>    ```
> 3. The script will:
>    - Inject a mail item with the malicious sync path.
>    - Wait 10 seconds for Outlook to process the mail.
>    - Scan Inbox and Drafts folders.
>    - Upon detection, normalize the path and trigger a system restart
> (`shutdown /r /t 5`).
>
> ---
>
> ## Warning
>
> - This script **will restart your computer** after 5 seconds once the
> payload is triggered.
> - Save all work before running.
> - Test only in a controlled or virtualized environment.
> - Do **NOT** run on production or important systems.
>
> ---
>
> ## Files
>
> - `PoC.py` - The Python proof-of-concept script.
> - `README.md` - This file.
>
> ---
>
> ## License
>
> This PoC is provided for educational and research purposes only.
>
> Use responsibly and ethically.
>
>
> # Reproduce:
> [href](https://www.youtube.com/watch?v=yOra0pm8CHg)
>
> # Source:
> [href](
> https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-47176)
>
> # Buy me a coffee if you are not ashamed:
> [href](https://www.paypal.com/donate/?hosted_button_id=ZPQZT5XMC5RFY)
>
> # Time spent:
> 03:35:00
>
>
> --
> System Administrator - Infrastructure Engineer
> Penetration Testing Engineer
> Exploit developer at https://packetstormsecurity.com/
> https://cve.mitre.org/index.html
> https://cxsecurity.com/ and https://www.exploit-db.com/
> 0day Exploit DataBase https://0day.today/
> home page: https://www.nu11secur1ty.com/
> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
>                           nu11secur1ty <http://nu11secur1ty.com/>
>
> На нд, 6.07.2025 г. в 9:53 nu11 secur1ty <nu11secur1typentest@gmail.com>
> н