Diagnostic

hackthebox

Task: Analyze a malicious Office document from a phishing campaign to extract the hidden flag. Solution: Unzip the DOCX to find an external OLE object referencing an HTML file that exploits CVE-2022-30190 (Follina) via ms-msdt:/ protocol, decode the base64 PowerShell payload, and deobfuscate format string reordering to reveal the flag embedded in the malware filename.