+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [0-Day] New Microsoft Office Zero-day allows attackers to run PowerShell scripts (/showthread.php?tid=6207689)
New Microsoft Office Zero-day allows attackers to run PowerShell scripts - Zher0 - May 31, 2022
CVE-2022-30190 aka "Follina" is likely to explode soon.
- uses Microsoft Diagnostic Tool (MSDT) to remotely access the payload
- does not require any privileges to execute
- works with the latest patched Office 2021
- is able to run via the RTF file format without opening the file (via windows file preview).
Full writeup: https://zerosecurity.org/2022/05/microsoft-office-zero-day-attack-follina-allows-attackers-to-execute-powershell
RE: New Microsoft Office Zero-day allows attackers to run PowerShell scripts - blackrose_x0x0 - Jun 1, 2022
Thanks for sharing. Pretty interesting vulnerability.
John Hammond also did a pretty great video on this as well that's worth checking out for those that are interested.
https://github.com/JohnHammond/msdt-follina
RE: New Microsoft Office Zero-day allows attackers to run PowerShell scripts - Zher0 - Jun 1, 2022
(Jun 1, 2022 06:57 AM)blackrosex0x0 Wrote: Thanks for sharing. Pretty interesting vulnerability.
John Hammond also did a pretty great video on this as well that's worth checking out for those that are interested.
https://github.com/JohnHammond/msdt-follina
Woah, thanks for the Github link
RE: New Microsoft Office Zero-day allows attackers to run PowerShell scripts - Bastille - Jun 2, 2022
Heard about Follina few days ago, fortunately it seems that Windows Defender is able to block the payloads based on known signatures, and behavior based when cloud-delivered protection & submission is enabled.
Here is another way to block the attack :
- Disable URL MSDT protocole by deleting the register key in HKEY_CLASSES_ROOT\ms-msdt (could be done through a GPO in organization I guess)
Besides, it seems that some AV are also able to block this exploit like Bitdefender, nothing mentioned by Kaspersky tho
Glade to see some guys in this section 😉
RE: New Microsoft Office Zero-day allows attackers to run PowerShell scripts - User_Ford - Sep 8, 2022
Very informative,, thànk you