Associated Vulnerability
Title:Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-30190)Description:A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
Description
All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools (MSDT) on Office apps such as Word. This is a very simple POC, feel free to check the sources below for more threat intelligence.
Readme
# follina (POC)
All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools (MSDT) on Office apps such as Word. This is a very simple POC, feel free to check the sources below for more threat intelligence.
# Usage
```commandline
usage: follina.py [-h] [--command COMMAND] [--ip IP] [--port PORT] [--output OUTPUT] [--reverse REVERSE]
POC for CVE-2022-30190, aka follina
options:
-h, --help show this help message and exit
--command COMMAND, -c COMMAND
The command to run on the victim (defaults to calc.exe)
--ip IP, -i IP IP to serve the payload on (defaults to 127.0.0.1)
--port PORT, -p PORT Port to serve the payload on (defaults to 4444)
--output OUTPUT, -o OUTPUT
Filename for output, should end with extension .doc, .docx or maybe .rtf (defaults to maldoc.docx)
--reverse REVERSE, -r REVERSE
Instantiate a reverse shell connection from the target at port furnished. 64-bits systems only.
```
# Workaround
Disabling MSDT from the registry should fix this issue
```
reg delete HKEY_CLASSES_ROOT\ms-msdt /f
```
# Sources
https://0xsp.com/offensive/follina-cve-2022-30190-rtf/
https://github.com/JMousqueton/PoC-CVE-2022-30190
https://github.com/JohnHammond/msdt-follina
https://youtu.be/dGCOhORNKRk
https://youtu.be/3ytqP1QvhUc
File Snapshot
[4.0K] /data/pocs/f58c854e61845bf739bb951a2ae2608f4ff39afe
├── [4.0K] docx
│ ├── [1.3K] [Content_Types].xml
│ ├── [4.0K] docProps
│ │ ├── [ 703] app.xml
│ │ └── [ 734] core.xml
│ ├── [4.0K] _rels
│ └── [4.0K] word
│ ├── [3.8K] document.xml
│ ├── [1.5K] fontTable.xml
│ ├── [4.0K] _rels
│ │ └── [ 969] document.xml.rels
│ ├── [2.9K] settings.xml
│ ├── [ 29K] styles.xml
│ ├── [4.0K] theme
│ │ └── [6.6K] theme1.xml
│ └── [ 802] webSettings.xml
├── [3.2K] follina.py
├── [1.0K] LICENSE
├── [1.4K] README.md
└── [4.0K] www
└── [ 44K] nc64.exe
7 directories, 14 files
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →