来源

关联漏洞

描述

All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools (MSDT) on Office apps such as Word. This is a very simple POC, feel free to check the sources below for more threat intelligence.

介绍

# follina (POC)
All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools (MSDT) on Office apps such as Word. This is a very simple POC, feel free to check the sources below for more threat intelligence.

# Usage
```commandline
usage: follina.py [-h] [--command COMMAND] [--ip IP] [--port PORT] [--output OUTPUT] [--reverse REVERSE]

POC for CVE-2022-30190, aka follina

options:
  -h, --help            show this help message and exit
  --command COMMAND, -c COMMAND
                        The command to run on the victim (defaults to calc.exe)
  --ip IP, -i IP        IP to serve the payload on (defaults to 127.0.0.1)
  --port PORT, -p PORT  Port to serve the payload on (defaults to 4444)
  --output OUTPUT, -o OUTPUT
                        Filename for output, should end with extension .doc, .docx or maybe .rtf (defaults to maldoc.docx)
  --reverse REVERSE, -r REVERSE
                        Instantiate a reverse shell connection from the target at port furnished. 64-bits systems only.
```

# Workaround
Disabling MSDT from the registry should fix this issue
```
reg delete HKEY_CLASSES_ROOT\ms-msdt /f
```

# Sources
https://0xsp.com/offensive/follina-cve-2022-30190-rtf/

https://github.com/JMousqueton/PoC-CVE-2022-30190

https://github.com/JohnHammond/msdt-follina

https://youtu.be/dGCOhORNKRk

https://youtu.be/3ytqP1QvhUc

文件快照

 [4.0K]  /data/pocs/f58c854e61845bf739bb951a2ae2608f4ff39afe
├── [4.0K]  docx
│   ├── [1.3K]  [Content_Types].xml
│   ├── [4.0K]  docProps
│   │   ├── [ 703]  app.xml
│   │   └── [ 734]  core.xml
│   ├── [4.0K]  _rels
│   └── [4.0K]  word
│       ├── [3.8K]  document.xml
│       ├── [1.5K]  fontTable.xml
│       ├── [4.0K]  _rels
│       │   └── [ 969]  document.xml.rels
│       ├── [2.9K]  settings.xml
│       ├── [ 29K]  styles.xml
│       ├── [4.0K]  theme
│       │   └── [6.6K]  theme1.xml
│       └── [ 802]  webSettings.xml
├── [3.2K]  follina.py
├── [1.0K]  LICENSE
├── [1.4K]  README.md
└── [4.0K]  www
    └── [ 44K]  nc64.exe

7 directories, 14 files

备注