THM-Tempest

TryHackMe — Tempest SOC Level 1 Pathway | Incident Response Investigation Overview Full incident response investigation of a compromised Windows machine. The attacker gained initial access via a malicious Word document exploiting CVE-2022-30190 Follina, established persistence, tunneled through t...

Malware-Analysis-Follina-CVE-2022-30190

Malware-Analysis-Follina-CVE-2022-30190 Static Malware Analysis – Follina Exploitation CVE-2022-30190 Malicious Microsoft Word Document Investigation During a practical malware analysis session on Kali Linux, I encountered a suspicious file named sample.doc. I decided to perform a structured stat...

CVE-2022-30190

MS-MSDT Follina CVE-2022-30190 PoC Malicious docx generator to exploit Microsoft Office Word Remote Code Execution Creation of this Script is based on CVE-2021-40444 PoC by LockedByte and writeup by Tothi Using First modify backup.html and replace powershell payload. Right now just pops a calc.ex...

follina_cve_2022-30190

follinacve2022-30190 A proof of concept to CVE-2022-30190 follina. root@kitploit: usage: exploit.py -h -u HOSTIP -p PORT -o OFILE -m server, create -s script | scriptfile.ps1 -r HOSTIP:PORT Follina Exploitation Toolkit options: -h, --help show this help message and exit -u HOSTIP, --host HOSTIP...

Follina-MSDT-Vulnerability-CVE-2022-30190-

Follina-MSDT-Vulnerability-CVE-2022-30190- Detection and Remediation of the Follina MSDT Vulnerability CVE-2022-30190 For detail inormatin about Follina-MSDT-Vulnerability-CVE-2022-30190- visit...

Follina-CVE-2022-30190-POC

Follina-CVE-2022-30190 Proof of Concept by Nee Usage root@kitploit: python3 follina.py --payload-url "http://192.168.200.144:1337/pwn.html" What it does Creates a malicious word file which points to the payload url that you specify Hosts the default payload located in the web folder Proof Of...

go_follina

gofollina Follina CVE-2022-30190 proof-of-concept. Inspired from : https://github.com/JohnHammond/msdt-follina https://github.com/chvancooten/follina.py...

FollinaScanner

FollinaScanner A tool written in Go that scans files & directories for the Follina exploit CVE-2022-30190 Note: "Suspicious files" means files that have a URL in them but isn't working Compiling root@kitploit: git clone https://github.com/ErrorNoInternet/FollinaScanner cd FollinaScanner go build...

five-nights-at-follina-s

Five Nights at Follina's A Fullstack Academy Cybersecurity project examining the full cycle of the Follina CVE-2022-30190 vulnerability, from exploit to detection and defense. Team: Brian Aldrich YoungWa Kim Jay O'Neill Binyang Jeffrey Xu This set of tools assumes that you have a web host or can...

Ninja

Actualización rápida para incluir la explotación Follina 01/06/2022 - NinjaC2 generará el documento y servirá el payload HTML. Más información: https://www.linkedin.com/posts/ahmed-khlief-499321a7i-just-pushed-a-quick-update-to-ninjac2-to-activity-6937661951007170560-Tmps Ninja V2.2 Publicado...

CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 Follina POC Host exploit.html on localhost, port 80. Open the docx to pop calc. To change the remote address the doc points to, open in 7Z and edit word\rels\document.xml.rels to point to a new location. YOU MUST keep the exclamation mark. It will literally not run i...

follina-spring

Follina MS-MSDT exploitation with Spring Boot This repository contains a simple Spring Boot application that acts both as a server to host/activate Follina payloads , and as a generator for malicious Word documents that are ready to be used as attack vectors to exploit CVE-2022-30190. This...

CVE-2022-30190-Follina-Patch

CVE-2022-30190-Follina-Patch This is a simple program allows you to complete the Workarounds temporary Patch at once instead of typing in cmd Addressed to specific people. Requires you to run it as an administrator. 6/2/2022 Images The exe file Manually Run Command Prompt as Administrator. To bac...

MSDT_CVE-2022-30190

MSDTCVE-2022-30190 This Repository Talks about the Follina MSDT from Defender Perspective Index About Timeline Understanding the Exploit List of IOCs Detection Strategy Testing and Researching Mitigation Plans References About The bug is a Microsoft Windows Support Diagnostic Tool MSDT remote cod...

CVE-2022-30190

CVE-2022-30190 Follina Proof of Concept Overview This project demonstrates a proof-of-concept exploit for CVE-2022-30190, also known as "Follina" —a critical remote code execution vulnerability affecting Microsoft Office via the MSDT protocol. The application generates malicious Office documents ...

Follina-CVE-2022-30190-Sample

Follina-CVE-2022-30190-Sample-by-ethical-blue Educational Follina Tool Version history v1.1 — JavaScript payload obfuscation v1.0 — Initial release Features .RTF payload generator Simple HTTP Server for payload Mitigation tips Configuration extractor Easy to use for learning Exploit Executed...

msdt-CVE-2022-30190

msdt-follina-office CVE-2022-30190- A Zero-Click RCE Vulnerability In MSDT...

Follina-CVE-2022-30190-Unofficial-patch

Follina-CVE-2022-30190-Unofficial-patch- An Unofficial Patch Follina CVE-2022-30190 patch by microsoft Guidelines. for more details goto : https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/ About Program this program creates a...

PicusSecurity4.Week.Repo

githubRepo for follina vuln CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina...

FOLLINA-CVE-2022-30190

FOLLINA-CVE-2022-30190 Implementation of FOLLINA-CVE-2022-30190 This repository contains an exploitation tool for the vulnerability FOLLINA-CVE-2022-30190 Disclaimer This tool developed for security testing and research purposes. by cloning / forking this tool the origin developer withdraw any...