CVE-2022-30190 PoC — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Source

https://github.com/yeep1115/ICT287_CVE-2022-30190_Exploit

Associated Vulnerability

Title:Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-30190)
Description:A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Description

Project on CVE-2022-30190 exploitation and mitigation strategies

Readme

# ICT287_CVE-2022-30190_Exploit
Project on CVE-2022-30190 exploitation and mitigation strategies
## 📌 About
This repository contains my final project for ICT287, where I explore the CVE-2022-30190 ("Follina") vulnerability. The project covers:
- Detailed analysis of the exploit
- Step-by-step execution process
- Mitigation strategies

## 🔥 Exploitation Demo
- Attacker Machine: Kali Linux 2024.1
- Victim Machine: Windows 10 Pro (Version 1809)
- Exploitation method: Malicious Word document executing remote code via MSDT
- Microsoft Office Pro Plus 2019 16.0.10325.20118

## 🛡️ Mitigation
- Disable MSDT URL Protocol
- Apply Microsoft Updates
- Enable Microsoft Defender with Cloud Protection

## 🔗 References
- [Microsoft CVE-2022-30190 Advisory](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190)
- [Follina Exploiter GitHub Repo](https://github.com/Hrishikesh7665/Follina_Exploiter_CLI)

## Credits & Acknowledgements
This project includes code from [Hrishikesh7665/Follina_Exploiter_CLI](https://github.com/Hrishikesh7665/Follina_Exploiter_CLI), 
which is licensed under [The Unlicense](https://unlicense.org/).

---

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!