134 matches found
CVE-2022-30190
CVE-2022-30190 CVE-2022-30190 Follina POC Host exploit.html on localhost, port 80. Open the docx to pop calc. To change the remote address the doc points to, open in 7Z and edit word\rels\document.xml.rels to point to a new location. YOU MUST keep the exclamation mark. It will literally not run i...
Malware-Analysis-Follina-CVE-2022-30190
Malware-Analysis-Follina-CVE-2022-30190 Static Malware Analysis – Follina Exploitation CVE-2022-30190 Malicious Microsoft Word Document Investigation During a practical malware analysis session on Kali Linux, I encountered a suspicious file named sample.doc. I decided to perform a structured stat...
Sigma-Rule-for-CVE-2022-30190
This repository does not have a README...
CVE-2021-40444
Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Update 31/05/2022 - CVE-2022-30190 - Follina Now the generator is able to generate the document required to exploit also the "Follina"...
Follina
Follina PATCHED Remote Access Shell for Windows based on cve-2022-30190 ⚠️ Made for Educational purposes only 📚 Installation & Usage 🛠️ $ git clone https://github.com/AbdulRKB/Follina.git $ cd Follina $ pip install -r requirements.txt $ python main.py...
cve-2022-30190
cve-2022-30190 Aka Follina = benign POC. Notes: Commit 5ea77 doesn't work...
FollinaExtractor
FollinaExtractor Extract payload URLs from Follina CVE-2022-30190 docx and rtf files usage: extractfollina.py -f C:\path\to\file.rtf...
CVE-2022-30190_EXP_PowerPoint
CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-30190 on PowerPoint. Modify the suffix of the file to 'zip' and unzip the file, you can edit \ppt\slides\rels\slide1.xml.rels and replace to your vps ip:port like this, then compress them as the same way and change the suffix to 'ppsx'. The...
follina.py
'Follina' MS-MSDT n-day Microsoft Office RCE Quick POC to replicate the 'Follina' Office RCE vulnerability for local testing purposes. Running the script will generate a clickme.docx or clickme.rtf payload file in your current working directory, and start a web server with the payload file...
follina
follina POC All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools MSDT on Office apps such as Word. This is a very simple POC, feel free to check the sources below for more threat intelligence. Usage usage: follina.py -h --command COMMA...
THM-Tempest
TryHackMe — Tempest SOC Level 1 Pathway | Incident Response Investigation Overview Full incident response investigation of a compromised Windows machine. The attacker gained initial access via a malicious Word document exploiting CVE-2022-30190 Follina, established persistence, tunneled through t...
msdt-follina
msdt-follina Microsoft MS-MSDT Follina 0-day Vulnerability CVE-2022-30190 Attack Vector...
Follina-Vulnerability-CVE-2022-30190-Exploit-Analysis
Follina-Vulnerability-CVE-2022-30190-Exploit-Analysis Exploration of the Follina CVE-2022-30190 Microsoft Office vulnerability, including a detailed analysis, proof-of-concept exploitation in a controlled lab, and mitigation strategies. For educational and research purposes only...
ZipScan
ZipScan A tool written in Go that scans files & directories for the Follina exploit CVE-2022-30190...
AmzWord
AmzWord an automated attack chain based on CVE-2022-30190, 163 email backdoor, and image steganography Thanks to the following github repository, we referenced and modified part of the code to integrate and implement our work: gdog follina virtual-reality 中文README请看这里 Requirements gdog： Python 2....
Cve-2022-30190
Cve-2022-30190...
cve-2022-30190
cve-2022-30190 CVE-2022-30190 remediation via removal of ms-msdt from Windows registry Resources Microsoft Guidance and Workaround Palo Alto Assessment...
follina-CVE-2022-30190
follina-CVE-2022-30190 follina zero day vulnerability to help Microsoft to mitigate the attack Description follina.py -h decompress nc64.zip at the root folder before usage...