let’s play with a ZERO-DAY vulnerability “follina”

NetworkChuck Technology Careers Career & Money

About this video

The creator, with hacking researcher John Hammond, walks through the then-new Follina zero-day (spoken in the transcript as CVE 2022-30190), a remote code execution flaw with no patch available at the time. The attack starts with a phishing email carrying a seemingly harmless Word document; it does not rely on macros, which are usually disabled. Instead, Word reaches out to an external reference staged with an HTML payload that invokes the Microsoft Support Diagnostic Tool (MSDT) via its protocol handler, letting the attacker run PowerShell or command prompt commands — from launching calculator to getting a full reverse shell, with lateral movement and privilege escalation possible from there. Hammond reverse-engineered the malicious document researchers found and recreated the ‘detonator’ as a Python script, since only the document itself was recovered from victims. The creator then builds a free lab: VirtualBox with a Kali Linux VM and a Windows 11 development-environment VM (noted as about 18.5 GB), installs Microsoft Office with the Office Deployment Tool, clones Hammond’s script on Kali, generates the malicious document, serves it over a Python web server after putting both VMs on a shared NAT network, and opens it in Windows. Windows Defender initially catches it, so he disables real-time protection in the lab; the document then launches calculator, can be re-pointed live to Notepad, and with the script’s reverse-shell option on port 9999 gives a Netcat shell on the Windows box. He stresses doing this only in a throwaway virtual lab and closes with the standard mitigation: teach users not to open strange emails or documents.

Key takeaways

Follina abuses the MSDT protocol handler via a Word document — no macros needed
A phishing document can yield a reverse shell and full remote control
Hammond recreated the exploit as a Python script from the recovered document alone
Lab recipe: VirtualBox, Kali plus Windows 11 VMs, Office via the deployment tool
Only run it in an isolated lab; user training remains the main real-world defense

Episode details: published June 1, 2022 · 21:21 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: you need to HACK faster!! (Linux Terminal hacks YOU NEED!!) · Next: the $0.30 Hacking Lab →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube