Simon Hryszko shirobachi

MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).

The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).

Here are the steps to build a Proof-of-Concept docx:

Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.

Chat GPT "DAN" (and other "Jailbreaks")

UPDATE: This is tested and working on both Linux and Windows 11 used for LlaMa & DeepSeek

Here's a sample README.md file written by Llama3.2 using this docker-compose.yaml file that explains the purpose and usage of the Docker Compose configuration:

ollama-portal

A multi-container Docker application for serving OLLAMA API.

	# set ruby/rails version
	export DOCKER_RAILS_VERSION="7.0.1"
	export DOCKER_RUBY_VERSION="3.1.0"
	export RAILS_PROJECT_NAME="rails7"
	# create folder for the project and add Gemfile with necessary rails version
	mkdir "$RAILS_PROJECT_NAME"
	cd "$RAILS_PROJECT_NAME"
	echo "ruby '$DOCKER_RUBY_VERSION'
	source 'https://rubygems.org'
	gem 'rails', '$DOCKER_RAILS_VERSION'" > Gemfile

	set -g TMUX_PLUGIN_MANAGER_PATH "$GITHUB_REPO_ROOT"
	set -g @plugin 'tmux-plugins/tpm'
	set -g @plugin 'wenijinew/glamour.tmux'