Microsoft Office OLE DLL Side Loading Vulnerability

This repository contains a single Metasploit module: 'office_ole_multiple_dll_hijack.rb', which exploits multiple DLL side-loading vulnerabilities in Microsoft Office OLE objects on Windows systems. The exploit works by generating a specially crafted Office document (such as a PowerPoint .ppsx file) that embeds a vulnerable OLE object. When the victim opens this document from a directory containing a malicious DLL (named according to the targeted component, e.g., mqrt.dll, spframe.dll, wuaext.dll, phoneinfo.dll), Windows will load the attacker's DLL, resulting in arbitrary code execution with the user's privileges. The module supports multiple targets, including various Office and Windows versions, and references several CVEs and Microsoft security bulletins. The default payload launches calc.exe, but any Metasploit payload can be used. The structure is typical for a Metasploit exploit: it defines targets, payload options, and methods for generating the malicious document and embedding the OLE object. The attack vector is local, requiring the victim to open the document from a directory containing the attacker's DLL. No network endpoints are involved; the main fingerprintable elements are the DLL filenames and the crafted Office document.