Local RCE, (MSDT) office, CVE-2022-30190

[0xCC]

executing code in MS Office without a macro

Follinaâââa Microsoft Office code execution vulnerability

Two days ago, Nao_sec identified an odd looking Word document in the wild, uploaded from an IP address in Belarus:

doublepulsar.com

 

[DarckSol]

Exploit....

Box

app.box.com

 

[grupenfurer]

как скрыть от песочниц и антивирусов, кто-нибудь придумал?

 

[WildMilk]

GitHub - JohnHammond/msdt-follina: Codebase to generate an msdt-follina payload

Codebase to generate an msdt-follina payload. Contribute to JohnHammond/msdt-follina development by creating an account on GitHub.

github.com

 

[riskandfraud]

Anyone has access to CVE 2022 30190 #Follina kit and ready to sell?

 

[Lipshitz]

Follina P2?

Wget the html payload as user = auto execute???

https://t.co/Cb5J5nnCM3

 

[astralded]

Why buy when you can make it yourself?
Please google Follina github POC and you will see several of them.

Here is the best one with step-by-step configuration.

GitHub - JMousqueton/PoC-CVE-2022-30190: POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina - JMousqueton/PoC-CVE-2022-30190

github.com

The funny thing is that overnight things changed, as of now Windows Defender is detecting the ms-mdt use. And it was all ok 5-7 hours ago.

 

[DanteXDark]

Why buy when you can make it yourself?
Please google Follina github POC and you will see several of them.

Here is the best one with step-by-step configuration.

GitHub - JMousqueton/PoC-CVE-2022-30190: POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina - JMousqueton/PoC-CVE-2022-30190

github.com

The funny thing is that overnight things changed, as of now Windows Defender is detecting the ms-mdt use. And it was all ok 5-7 hours ago.

is there any way to bypass AV's ?

 

[astralded]

is there any way to bypass AV's ?

For now the trigger is the use of ms-mdt.
Need to play with it.
Thats what I am doing at the moment )

 

[acide]

MS-MSDT 0-day Office RCE PoC :

https://gist.github.com/tothi/66290a42896a97920055e50128c9f040

https://github.com/JohnHammond/msdt-follina
https://github.com/chvancooten/follina.py

 

[DanteXDark]

For now the trigger is the use of ms-mdt.
Need to play with it.
Thats what I am doing at the moment )

can we obfuscate the html file? (stupid question btw )

 

[Lipshitz]

Seems that there may be other ms proprietary protocols that could be useful instead of ms-mdt:

 

[astralded]

can we obfuscate the html file? (stupid question btw )

There is no stupid question.
What is interesting was the fact that this method opened up more bugs.

So I wouls suggest you research it step by step and read up other CVEs. Eventually you might come up with something similar.

Obfuscating the html woudlnt work in this case as it would be detected after it is deobfuscated and executed.

 

[DanteXDark]

There is no stupid question.
What is interesting was the fact that this method opened up more bugs.

So I wouls suggest you research it step by step and read up other CVEs. Eventually you might come up with something similar.

Obfuscating the html woudlnt work in this case as it would be detected after it is deobfuscated and executed.

windows defender detects [word\_rels\document.xml.rels] this file, is it pssible to Obfuscate this file ? OR maybe we can use any other protocol instead of ms-mdt:.

 

[marauda18]

The best way to know is testing!

Not only static analysis are detecting this CVE now,but behavior analysis too. It's very suspicious winword.exe spawning msdt.exe and another child process like powershell.exe for example.

 

[astralded]

windows defender detects [word\_rels\document.xml.rels] this file, is it pssible to Obfuscate this file ? OR maybe we can use any other protocol instead of ms-mdt:.

Totally, continue testing and share your results.

The best way to know is testing!

Not only static analysis are detecting this CVE now,but behavior analysis too. It's very suspicious winword.exe spawning msdt.exe and another child process like powershell.exe for example.

But in this case because you are using the highly reputable protocol, t was allowing to launch apps. One direction for tests are powershell scripts as well.

 

[la-of-sh]

This is good explanation, with step by step(also obfuscated filee upload) https://github.com/AchocolatechipPancake/MS-MSDT-Office-RCE-Follina

 

[hackera]

do you have pollina tutorial?

 

[DarckSol]

_Metasploit_

 

[xerxes]

_Metasploit_

where in metasploit can i use this module?