let’s play with a ZERO-DAY vulnerability “follina”

A newly discovered “Follina” (CVE-2022-3019) zero-day vulnerability in Microsoft Word can enable remote code execution with no official patch available at the time of discovery. Researchers say it’s high severity because it can turn a simple phishing lure—often a Word document delivered via email—into full control of a victim machine, including the ability to run PowerShell or command-line commands and establish a reverse shell.

The attack chain starts when a victim opens a crafted Word document. Instead of relying on the more common Office macro route, the malicious document triggers Microsoft Support Diagnostic Tool (MSDT). MSDT is designed for troubleshooting, but in this scenario it can be abused to execute attacker-controlled commands. The Word document reaches out to an external reference, stages an HTML payload, and then uses a file-protocol handler to kick off code execution. From there, the attacker can run arbitrary commands—ranging from harmless actions like launching Calculator to more dangerous outcomes such as spawning a reverse shell for remote access.

What makes the exploit particularly concerning is how quickly it can escalate. Once an attacker has a foothold, they can use the established access to move laterally across systems, attempt privilege escalation, and potentially deploy follow-on payloads such as remote access trojans, cryptocurrency miners, or ransomware. Researchers also note that the “real” malicious payload used in the wild may include additional capabilities beyond what’s demonstrated in lab recreations.

Because the vulnerability was brand new, researchers only had partial evidence: the malicious Word document “detonator” and the observed behavior, but not the full malware tooling used by attackers. That gap is where reverse engineering comes in. John Hammond and other researchers reconstructed the missing components by analyzing the document and recreating the exploit logic, enabling a safe lab demonstration of how the zero-day works.

The walkthrough then shifts from mechanics to replication. It lays out a free lab setup using VirtualBox, a Kali Linux VM to host the exploit tooling, and a Windows 11 VM with Microsoft Office installed. The lab uses a Python script (Felina.py) to generate a malicious Word document (Felina.doc) that points back to a local web server. After downloading the document into Windows and enabling editing in Word’s protected view, the document attempts to contact the attacker-controlled server and triggers the MSDT-based execution path.

In the demo, Windows Defender flags the activity as “MSDT” related, which can interfere with observing the behavior. The lab workaround involves temporarily disabling real-time protection to let the recreated payload run long enough to test commands. With the environment working, the script supports multiple command options: launching benign apps like Notepad, and—more critically—starting a reverse shell via netcat so the attacker can issue commands and enumerate the system.

The practical takeaway is blunt: the best mitigation remains user and email hygiene—avoid opening suspicious documents and treat phishing attempts as dangerous even when macros are disabled. For deeper technical detail and ongoing updates as the vulnerability evolves, the transcript directs viewers to John Hammond’s research and related write-ups.