CVE-2022-30190 (Follina)

Educational Malware Development, Exploitation, Analysis and Mitigation

A fully documented proof-of-concept demonstrating the Follina vulnerability - from social engineering delivery through to exploitation, forensic analysis, and patch development.

⚠️ Educational Use Only. All activities in this repository were conducted exclusively within an isolated virtual machine lab environment as part of the IE4012 Offensive Hacking Tactics & Strategies module at SLIIT. Nothing here should be used outside a controlled lab. Do not test against real systems or networks.

📋 Overview

CVE-2022-30190, nicknamed Follina, is a remote code execution vulnerability in the Microsoft Support Diagnostic Tool (MSDT). It was publicly disclosed on 30 May 2022 and assigned a CVSS score of 7.8 (High). The exploit fires when a victim opens a specially crafted Microsoft Office document - no macros required. The document fetches an HTML payload from an attacker-controlled HTTP server, which invokes the ms-msdt: URI protocol handler and passes arbitrary commands to the system through the PCWDiagnostic argument.

🗂️ Repository Structure

SourceCode.zip/
├── PoC.py                                  # Main exploit script
├── patch.py                                # Mitigation patch script
├── Invoice_FS-2026-8821_OVERDUE.docx       # Generated malicious Word document
└── doc/                                    # Internal XML files extracted from the docx
    ├── word/
    │   ├── document.xml                    # Main document body
    │   └── _rels/
    │       └── document.xml.rels           # External OLE reference pointing to attacker server
    └── [Content_Types].xml

🚀 How It Works

Phase 1 - Social Engineering Delivery

The lure is a phishing email impersonating a billing platform called FinanceSync, claiming an invoice is overdue. The attachment is a password-protected zip archive (Invoice.zip) containing the malicious Word document. Using an encrypted archive bypasses most email gateway scanners since the contents cannot be inspected.

Phase 2 - Exploit Chain

• PoC.py generates Invoice_FS-2026-8821_OVERDUE.docx and starts an HTTP server on port 8000
• The document contains an external OLE reference in word/_rels/document.xml.rels pointing to http://<attacker_ip>:8000/index.html
• When the victim opens the document, Word automatically fetches the HTML payload - no user prompt, no macros
• The HTML payload contains a JavaScript date check against a hardcoded trigger date (2026-03-25). If the date condition is not met, nothing executes
• Once the condition passes, the ms-msdt: URI is fired with a PCWDiagnostic argument containing a cmd.exe command
• The process chain WINWORD.EXE → msdt.exe → cmd.exe executes and writes sys_cache.dat to C:\Users\Public\ as proof of compromise

Phase 3 - Patch

patch.py removes the ms-msdt URI protocol handler from the Windows registry, breaking the exploit chain at the URI resolution stage before any attacker-controlled arguments can reach MSDT.

⚙️ Usage

Prerequisites

Attacker machine (Kali Linux)

• Python 3

Victim machine (Windows 10)

• Microsoft Office installed (unpatched build)
• ms-msdt registry key present under HKEY_CLASSES_ROOT
• System date set to 2026-03-25 or later

Running the PoC

# On the attacker machine
python3 PoC.py

The script generates the Word document and starts the HTTP server. Transfer the document to the victim VM and open it. The attacker terminal will log the incoming request from Word.

Running the Patch

The patch script must be run as Administrator on the Windows victim VM.

# Check current status
python patch.py --status

# Apply the patch (removes ms-msdt registry key)
python patch.py --apply

# Roll back to vulnerable state (for re-testing)
python patch.py --rollback

🔬 Vulnerability Details

🛡️ Patch Effectiveness

🧠 Lab Environment

Both VMs were connected via a VirtualBox Host-Only network with no internet access.