This module exploits a vulnerability in the wkimgsrv.dll control shipped with Microsoft Works and many Microsoft Office Suites. The exploit is triggered when the WksPictureInterface() method processes a number as argument resulting in a memory corruption. The WksPictureInterface(), in certain circumstances, points to an invalid memory address that can be controlled to gain code execution. This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

This module exploits a vulnerability in Microsoft Office (.WPS files). The vulnerability is caused due to boundary errors within the processing of WPS files. This can be exploited to cause a stack-based buffer overflow when a specially crafted file is opened. This module runs a malicious web site on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site.

Buffer overflow in Microsoft Office allows remote attackers to execute arbitrary code via crafted TIFF data in an Office document, leading to improper memory allocation.

This module exploits a vulnerability in Microsoft Word 2010 when parsing a specially crafted RTF file. This vulnerability was found being exploited in-the-wild during March 2014.

This module exploits a vulnerability in Microsoft Office Word (.DOC files). The vulnerability is caused due to a boundary error in winword.exe within the processing of DOC files. This can be exploited to cause a memory corruption when a specially crafted file is opened. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module exploits a memory corruption in Microsoft Word is caused due to an error within the TabStrip ActiveX control (MSCOMCTL.OCX) object, embedded in a RTF crafted file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

Unspecified vulnerability in Microsoft Word allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption.

A malformed Microsoft Word document allows an attacker to execute arbitrary code. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

Microsoft Word is prone to a vulnerability that may allow execution of ehTrace.dll if this dll is located in a special named folder than .DOC file. The attacker must entice a victim into opening a specially crafted .DOC file. This file and the associated binary may be delivered to a user through remote WebDAV shares. An attacker may exploit this issue to execute arbitrary code.

This module exploits a memory corruption vulnerability on the Word 97 Text Converter component of Microsoft WordPad while parsing a malformed Word 97 .DOC file.