CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability

This script provides a proof of concept (PoC) for CVE-2024-21413, a critical security vulnerability discovered in Microsoft Outlook with a CVSS score of 9.8. This vulnerability, dubbed the MonikerLink flaw, has wide-ranging implications including potential leakage of local NTLM information and the possibility of remote code execution.

🚀 Usage

Use this tool responsibly and ensure you have authorization from the owner of the target system. This script requires SMTP authentication to send an email while bypassing SPF, DKIM, and DMARC checks, helping to simulate a real-world attack scenario more effectively.

python CVE-2024-21413.py --server "" --port --username "" --password "" --sender "" --recipient "" --url "" --subject ""

Parameters:

--server: SMTP server hostname or IP. --port: SMTP server port. --username: SMTP server username for authentication. --password: SMTP server password for authentication. --sender: Sender email address --recipient: Recipient email address . --url: Malicious path to include in the email. --subject: Email subject.

Wireshark capture containing NTLM credentials (alternatively you can run impacket)

🧐 Why SMTP Authentication? SMTP authentication is crucial for this demonstration to ensure that the sent email bypasses common email verification checks such as SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These security measures are designed to detect and prevent email spoofing, where attackers send emails from a forged address. By using authenticated SMTP, the demonstration closely mimics how a sophisticated attacker could circumvent these protections, making the test environment more realistic and highlighting the importance of comprehensive email security practices.

📆 Changelog [February 19, 2024] - Added 0-Click NTLM Leak Confirmed and managed 0-click NTLM Leak (thanks to JT!) Not yet published [February 18, 2024] - Added 1-click RCE Managed & confirmed Microsoft Outlook Remote Code Execution (RCE) Not yet published [February 16, 2024] - Initial Release Initial release showcasing the exploit for CVE-2024-21413. Credits Checkpoint has done all the amazing research. Microsoft Security Advisory 📌 Author Alexander Hagenah

Website Twitter LinkedIn ⚠️ Disclaimer This tool is intended solely for educational and ethical testing purposes. Unauthorized scanning, testing, or exploitation of systems is illegal and unethical. Ensure you have explicit and authorized permission before conducting any testing or exploitation activities against target systems.