CVE-2022-30190 (Follina)-Microsoft Support Diagnostic Tool Vulnerability
Table of Content
- Explain CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability
- How to Exploit Microsoft Support Diagnostic Tool?
Explain CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability:
On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability.
A remote code execution (RCE) vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s right.
How to Exploit Microsoft Support Diagnostic Tool?
Before exploiting this flaw, let me show you the release information of Microsoft Word. I use Microsoft Office Professional Plus 2013 version.
Kali Linux : (Attacker System)
There are several exploits on GitHub related to the (MSDT) Microsoft Support Diagonist tool. I would like to prefer John Hammond GitHub page (who is a cybersecurity researcher, educator, and content creator). Let’s have a look on the image.
Copy Link: https://github.com/JohnHammond/msdt-follina.git
First, I will create a folder named Office-Exploit. It’s my choice, you can create a folder with any name. Then we will enter the Office-Exploit folder and clone the GitHub link.
mkdir Office-Exploitcd Office-Exploitgit clone https://github.com/JohnHammond/msdt-follina.git
Before Exploiting (MSDT) Microsoft Support Diagnostic Tool, let’s enter the msdt-follina directory and fire the ls command. There are some files and folders but we are interested in follina.py python script.
As well as in my second pane, there is an IP address of the Kali Linux machine.
Before executing follina.py script, the python3 package should be installed into our system, otherwise follina.py script will raise an error. Follow the below command.
python3 follina.pyAfter executing the above command, a malicious file named follina.doc is generated.
follina.doc is a malicious file. We have to send this file to our target system. For that, you can use any third-party web server. But we will use the python3 HTTP server (Python3 SimpleHTTPServer is a built-in HTTP server in which you don’t have to install and configure anything).
python3 -m http.server 80
Windows 10 : (Target System)
We have successfully downloaded the follina.doc malicious file from google chrome using the python3 http web server.
Let’s open follina.doc malicious file in M.S Word.
As soon as I tried to open the follina.doc file from Microsoft Word, the “program compatibility troubleshooter” dialog box opened. OH MY GOD, my Windows system calculator suddenly opened.
Watch This Video: How to get Reverse Shell, And How to Compromise Fully Windows 10
Follina — Exploiting MS-MSDT 0-Day CVE-2022-30190 | Alert! Everyone Windows Hacked
Recent Posts
- Protected: How To Mount USB Drive in Ubuntu Linux
- CVE-2022-30190 (Follina)-Microsoft Support Diagnostic Tool Vulnerability
- SQL INJECTION – Extracting Username and Password From Database
- How To Dump Username And Password Using SQLMap Tool?
- Protected: Exploit Apache Log4j Security Vulnerabilities – CVE-2021-44228
Most Popular Posts
The professional hacker true out the word that I believed in him is only Henryclarkethicalhacker Group Hackers Checked Google and see everybody comments on him he a professional that I believed in him if you have problems on any stuffed like a bank, company, school grades change examinations, database, Social media hacks, Email hacks, Phone hacks, Bitcoin hacks, increased Credit score boost to 800, School result upgrading, cryptocurrency, Binary option funds recovery, Bitcoin Mining, Instagram, WhatsApp, Twitter, Monitor your colleague, access your spouse social media, and a lot more, via, , on whatsapp 18134211326..
Contact him for any type of hacking, he is a professional hacker that specializes in exposing cheating spouses, and every other hacking related issues. he is a cyber guru, he helps catch cheating spouses by hacking their communications like call, Facebook, text, emails, Skype, whats-app and many more. I have used this service before and he did a very good job, he gave me every proof I needed to know that my fiancee was cheating. You can contact him on his email to help you catch your cheating spouse, or for any other hacking related problems, like hacking websites, bank statement, grades and many more. he will definitely help you, he has helped a lot of people, contact him on, , and you can Text/Call &WhatsApp: +1 (773)-609-2741, or +1201-430-5865, and figure out your relationship status. I wish you the best.
Hello Guys, I just completed my divorce with my cheating husband of 10 years with two beautiful kids when i got a solid evidence of his unfaithfulness on extra marital affairs and his infidelity lifestyle, And the various applications he used to hide chats and lot of secret on his cell phone. Then, i decided to hire (Henryclarkethicalhacker@gmail com), an hacker and a PI just to be 100% sure because i don’t want to confront him or take any kinda step without proof, fact and figures because that could leads to defamation… It was with this great, honest, professional and trustworthy Man i got to know my husband is a professional cheater and has been using this app to hide most of his chats. This great hacker helped me broke to into his cell phone activities and wired everything he does on his cell phone directly to my phone and i was able to monitor and track him directly from my phone remotely without him knowing, contact Henry via, whatsapp, call or text him on +17736092741, or 1201-430-5865.
My girlfriend was very smart at hiding her infidelity from me due to some selfish reasons. So I had no proof for weeks while hurting myself during this process. Luckily I was referred to this private investigator and the result was awesome and top notch. All my girlfriend’s dirty chats, Facebook, WhatsApp, Instagram, and even phone conversations were directed to my cell phone, if your girlfriend, boyfriend, wife or husband are experts at hiding his or her cheating adventures, contact this fast and trusted link. You can reach them via, TEXT,Call & Whatsapp,+1(201)4305865, or +1(773)6092741…
My girlfriend was very smart at hiding her infidelity from me due to some selfish reasons. So I had no proof for weeks while hurting myself during this process. Luckily I was referred to this private investigator and the result was awesome and top notch. All my girlfriend’s dirty chats, Facebook, WhatsApp, Instagram, and even phone conversations were directed to my cell phone, if your girlfriend, boyfriend, wife or husband are experts at hiding his or her cheating adventures, contact this fast and trusted link. You can reach them via, TEXT,Call & Whatsapp,+1(201)4305865, or +1(773)6092741…
;oiuyt
A great hacker is really worthy of good recommendation , Henry
really help to get all the evidence i needed against my husband and
and i was able to confront him with this details from this great hacker
to get an amazing service done with the help ,he is good with what he does and the charges are affordable, I think all I owe him is publicity for a great work done via, , and you can text, call him on whatsapp him on +12014305865, or +17736092741,
A great hacker is really worthy of good recommendation , Henry
really help to get all the evidence i needed against my husband and
and i was able to confront him with this details from this great hacker
to get an amazing service done with the help ,he is good with what he does and the charges are affordable, I think all I owe him is publicity for a great work done via, , and you can text, call him on whatsapp him on +12014305865, or +17736092741,