Keysight‘s Take on CVE-2022-30190 MSDT Follina Exploit

CVE-2022-30190 Microsoft Windows Support Diagnostic Tool (MSDT) RCE vulnerability has taken the internet by storm with it being still a zero-day since its discovery on March 27. There is a lot of information publicly disclosed and since it's so simple to perform the attack and most of the Windows versions (except some old versions) are vulnerable, makes it pretty dangerous.

We already see a lot of malware samples being submitted to malware database (Image from MalwareBazaar attached below) sites involving Follina exploit armed with various tools like C2 Framework Cobalt Strike and others.

There have also been reports that the APT group TA413 has been actively exploiting this vulnerability to steal and delete users' data.

How does it start?

This all started when a malloc sample was shared by naosec on Twitter. It used the Word doc to pull an HTML file from a server which looked like the following:

The document seems to be invoking the most tool with some parameters and trying to execute some base64 encoded strings. If we decode it, we can see what it's trying to do -

It's trying to run the command prompt in hidden mode and kill the most process itself to do some cleanup.

Then it tries to go to the C:\Users\public directory and tries to copy some rare file, which probably came with the doc, and then tries to find some base64 encoded string in that rar file.

If we decode that string 'TVNDRgAAAA', we can see it decodes to 'MSCF...', on doing a little bit of search, we found that these are the magic bytes of an archive file format called Cabinet, by Microsoft and saves it to a file called 1.t and then it expands the archive and tries to run a file present inside called rgb.exe which again could be the stage 2 payload like some Remote Access Trojan which might further help in getting control of the victim.

So now, the question is what made the original Word doc reach out to the attacker server for this HTML file? To answer that let's try to recreate one of the many online POC that are available.

Testing the POC

We got hold of an online POC that researcher and YouTuber John Hammond has posted

◆ git clone https://github.com/JohnHammond/msdt-follina.git on the attacker machine

◆ cd set-following && python3 follina.py -i ens33

◆ The Word doc should be created.

◆ We want to test out the exploit version where we won't have to open the Word Doc to be exploited (We need windows preview mode to be enabled for this), for this, if we open this Word doc and save it as RTF format.

◆ Now if we send this malicious Doc in RTF format to the victim machine(Windows) and in windows explorer, we enable the preview pane.

To trigger it, just left-click on the RTF file which opens the preview mode on the right, and bam it's game over. The POC pops open the calculator which is what it is supposed to do. So, this proves that we have Remote Code Execution.

As of writing this blog, Microsoft has included signatures of detecting Follina, so Windows Defender might block the connection to the attacker server, so you might need to disable Defender to execute the POC successfully. NOTE: There have been rumours of POCs which are able to evade the Defender detection.

Analysing the POC

Let's go back to the original question, 'what made the original Word doc reach out to the attacker server for this HTML file?' If we unzip the doc file and see the file 'document.XML.rels' which according to the following, contains references to media. 

It's trying to look for an OLE object which is external and therefore tries to download it from the URL in the target tag, which is why it reaches the attacker server.

So, what did we download from that attacker's server? It's an HTML file like what we saw at the beginning of the blog –

We can see the command to execute 'calc' embedded as base64 encoded string 'Y2FsYw==' and we also see a bunch of commented random characters. According to some initial PoCs, the exploit only works when the total size of the HTML file is 4096 bytes or higher, hence the padding, although there have been some rumours of some modified payload where this it's not necessary.

Other Attack Vectors

According to this Twitter post , a simple wget or Invoke-WebRequest request from PowerShell to the attacker server also has the same result. This has been verified to be working by us (you might get an `Internet Explorer(IE) Engine not available` error, just launch IE once to get around). Judging by the nature of the attack, there might be other attack vectors which are still unknown.

Mitigations

As of now there is no patch for this vulnerability by Microsoft. You can follow these guidelines to stay safe -

◆ Disable the MSDT URL protocol which prevents launching the MSDT tool from links. To do the same you can –

◆ Turn this off : Group Policy Editor -> Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Scripted Diagnostics. Set "Troubleshooting: Allow users to access and run Troubleshooting Wizards" to "disabled".

◆ The other option is to keep your Windows Defender up and updated but as we said earlier there have been incidents of payload getting around it.

◆ You can also use the KEYSIGHT test platforms with an ATI subscription to safeguard your network against such attacks. Keysight Threat Simulator or BreakingPoint products can help you assess your network security controls and determine whether you can be protected before the patch. This kind of assessment is valuable as it can let you know if you have protection during the time before a change management window will open.

Leverage subscription service to stay ahead of attacks

Keysight's Application and Threat Intelligence (ATI) Subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Centre continuously checks threats as they appear in the wild and has released a strike for the Follina Exploit as part of BreakingPoint System's recent update 2022-12 with multiple variations of the attack to help keep your network secure. 

The following image shows screenshots of the CVEs as a strike in BreakingPoint System: