# Exploit Title: Microsoft Office365 Remote Code Execution Vulnerability
# Date: 2/11/19
# Exploit Author: Social Engineering Neo - @EngineeringNeo
# Vendor Homepage: https://microsoft.com
# Software Link: https://office.com
# Version: Office365/ProPlus (build 16.0.11727.20222, 16.0.11901.20170, 16.0.11901.20204 & 16.0.11929.202.88)
# Tested on: Windows 10 (build 17763.253, 18362.295 & 18362.356)


Affected Platforms: -
Microsoft Windows ≤10
Office365 & ProPlus Products ≤2019


Tested On: -
Windows 10 (build 17763.253, 18362.295 & 18362.356)
Office365/ProPlus (build 16.0.11727.20222, 16.0.11901.20170, 16.0.11901.20204 & 16.0.11929.202.88)
Most up to-date version of Microsoft Windows & Office365/ProPlus Products are affected.


Base: -
CWE-325 - Missing Required Cryptographic Step.
The software does not implement a required step in a cryptographic algorithm used to validate the original integrity of documents.


Summary: -
Improper Integrity Validation of Office Documents Resulting in Multiple Microsoft Office Products Suffering from a Protection Bypass Vulnerability. Allowing Auto-Execution of Macro Code Inside Macro-Enabled Office Documents.


Short Description: -
Overwriting an original macro-enabled document with a malicious document will bypass the built-in protections.


Long Description: -
A user creates a macro-enabled MS Word document and saves the document with text/data inside.
If the user deletes the document and downloads a completely different document with the same name, this can allow remote code execution.
When a document is opened/edited, Office apps keep a record of the name and permissions associated with the specific document.
This can be abused when downloading a malicious document to run code remotely on the machine.


Proof of Concept: -
=====
Tested on Latest Versions of Access, Excel, InfoPath, OneNote, Outlook, PowerPoint, Project, Publisher, Visio, Word.

Affects Access, Excel, InfoPath, PowerPoint, Visio, Word.
Does not affect OneNote, Outlook, Project, Publisher.

ATTACKER: -
Step 0.) -  Knowledge of Office document names on VICTIM device.
Step 1.) -  Inject malicious VBA macro code & payload into Office document.    *preferably AV evasive*
Step 2.) -  Send malicious macro-enabled document to VICTIM through internet.
Step 3.) -  Setup bind/reverse connection.

VICTIM: -
Step 1.) -  Download document sent by ATTACKER.
Step 2.) -  Open Document in same location as previous document.

[CODE EXECUTION SUCCESSFUL]

VIDEO: -   https://youtu.be/YVF7gqWZSGE
=====


Expected Result: -
It shouldn't be possible to automatically execute macro code on the host machine without user consent or additional configuration.
(Clean Install)


Observed Result: -
Office document auto-executes macro code upon loading document without any user consent, in our case leading to remote code execution.
(User Level Access)