POC详情： ca0796d5936546a7cc2539de77f72d9210ce7591

来源
https://github.com/hycheng15/CVE-2022-30190
关联漏洞
标题： Microsoft Windows Support Diagnostic Tool 操作系统命令注入漏洞 (CVE-2022-30190)
描述：Microsoft Windows Support Diagnostic Tool是美国微软（Microsoft）公司的收集信息以发送给 Microsoft 支持的工具。 Microsoft Windows Support Diagnostic Tool (MSDT)存在操作系统命令注入漏洞。以下产品和版本受到影响：Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows
描述
An exploitation of CVE-2022-30190 (Follina)
介绍
# CVE-2022-30190

> Based on https://github.com/JohnHammond/msdt-follina

## Environment Setup
> Use files in /env-setup
1. Virtual Machine: use VirtualBox and [Win10_21H2_English_x32.iso](https://drive.google.com/file/d/1J2vBbrps2A3LL3XMexloBt70OdvI_vWn/view?usp=drive_link) (Build 19044.1288)
2. Install Microsoft Word, run `setup.exe /configure configuration.xml` using cmd inside /env-setup/odt-2013
3. Install Python 3.8.10

## Exploitation
1. Turn off Virus and Threat Scanning in Window's settings
2. Make sure you have all the Python packages needed
    * Often need to install netifaces using `pip install netifaces`
3. Get your machine's IP address (`ipconfig`)
4. Run `py folina.py -i <ip-address>` (refer to the original repo for more details)
5. Open the malicious doc file. Then the msdt, sdiagnhost and a calcualtor should pop up

<img src="https://github.com/meowhua15/CVE-2022-30190/assets/74200918/b3dc2360-11f4-476e-b457-0f5108ef5172"  width=40%> <img src="https://github.com/meowhua15/CVE-2022-30190/assets/74200918/e73ff6ae-727c-4c5f-a370-7c80790ff8d5"  width=40%> <img src="https://github.com/meowhua15/CVE-2022-30190/assets/74200918/111b6e3e-b106-4a09-bd39-76ea6b8561bc"  width=40%>
文件快照

 [4.0K]  /data/pocs/ca0796d5936546a7cc2539de77f72d9210ce7591
├── [4.8M]  CVE-2022-30190-Report.pdf
├── [4.0K]  doc
│   ├── [1.3K]  [Content_Types].xml
│   ├── [4.0K]  docProps
│   │   ├── [ 703]  app.xml
│   │   └── [ 734]  core.xml
│   ├── [4.0K]  _rels
│   └── [4.0K]  word
│       ├── [3.8K]  document.xml
│       ├── [1.5K]  fontTable.xml
│       ├── [4.0K]  _rels
│       │   └── [ 974]  document.xml.rels
│       ├── [2.9K]  settings.xml
│       ├── [ 29K]  styles.xml
│       ├── [4.0K]  theme
│       │   └── [6.6K]  theme1.xml
│       └── [ 802]  webSettings.xml
├── [4.0K]  env-setup
│   ├── [4.0K]  odt-2013
│   │   ├── [ 307]  configuration.xml
│   │   └── [1.1M]  setup.exe
│   ├── [ 26M]  python-3.8.10.exe
│   └── [4.0K]  sysmon
│       ├── [7.2K]  Eula.txt
│       ├── [4.6M]  Sysmon64a.exe
│       ├── [4.2M]  Sysmon64.exe
│       └── [7.8M]  Sysmon.exe
├── [5.0K]  follina.py
├── [4.0K]  log
│   └── [ 68K]  log.evtx
├── [ 44K]  nc64.exe
└── [1.2K]  README.md

10 directories, 22 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。