CVE-2022-30190 PoC — Microsoft Windows Support Diagnostic Tool 操作系统命令注入漏洞

Description

Project on CVE-2022-30190 exploitation and mitigation strategies

介绍

# ICT287_CVE-2022-30190_Exploit
Project on CVE-2022-30190 exploitation and mitigation strategies
## 📌 About
This repository contains my final project for ICT287, where I explore the CVE-2022-30190 ("Follina") vulnerability. The project covers:
- Detailed analysis of the exploit
- Step-by-step execution process
- Mitigation strategies

## 🔥 Exploitation Demo
- Attacker Machine: Kali Linux 2024.1
- Victim Machine: Windows 10 Pro (Version 1809)
- Exploitation method: Malicious Word document executing remote code via MSDT
- Microsoft Office Pro Plus 2019 16.0.10325.20118

## 🛡️ Mitigation
- Disable MSDT URL Protocol
- Apply Microsoft Updates
- Enable Microsoft Defender with Cloud Protection

## 🔗 References
- [Microsoft CVE-2022-30190 Advisory](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190)
- [Follina Exploiter GitHub Repo](https://github.com/Hrishikesh7665/Follina_Exploiter_CLI)

## Credits & Acknowledgements
This project includes code from [Hrishikesh7665/Follina_Exploiter_CLI](https://github.com/Hrishikesh7665/Follina_Exploiter_CLI), 
which is licensed under [The Unlicense](https://unlicense.org/).

---

文件快照

备注