d1se0/cve-2024-21413-vulnerabilidad-outlook-lab
#CVE-2024-21413 – Outlook LAB Vulnerability
Vulnerability Description
CVE-2024-21413 is a critical vulnerability discovered in Microsoft Outlook that allows a remote attacker to execute malicious links via a carefully crafted email. This exploit uses the file:// protocol to redirect victims to attacker-controlled SMB shares, which may result in exposure of NTLM credentials or unauthorized access to local files.
The password for user victim is victim in Windows 10 lab and the password for server hMailServer is victim
The password for the [email protected] email is victim and the password for the [email protected] email is hacker
Install python3 in the Windows 10 lab:
We will open a cmd as administrator:
pip install pyautogui
pip install Pillow
pip install opencv-python
We will have to download the following script in the Windows 10 laboratory:
startServicesWindows.py
python3 startServicesWindows.py
To start the mail server and Outlook, in order to have the environment prepared.
Attack Vector: The attack is initiated by sending an email with a file:// link to the victim. When clicked, the system attempts to connect to the specified remote share, potentially exposing NTLMv2 credentials or accessing a compromised local resource.
Impact: Theft of NTLM credentials, remote command execution or exploitation of local files.
A functional SMTP server.
Access to the victim computer through Outlook.
Valid credentials of the email sender.
This repository contains two tools designed for testing in a controlled environment:
A utility in Python that automates sending emails with malicious file:// links to test the vulnerability in secure environments.
Allows you to configure sender, recipient and sender password.
Link embedded in the body of the email that exploits the file:// protocol.
Designed to run with an SMTP server.
Install the necessary dependencies:
pip install rich
python3 exploitSendEmailOutlook.py
Email address of the sender (attacker).
Email address of the recipient (victim).
Password of the sender.
IP of the SMTP server.
The email will be sent automatically if authentication and connection are successful.
Trying to connect to SMTP server...
Connection established with SMTP server.
Trying to log in to SMTP server...
Authentication successful.
Sending email...
Email sent successfully.
Responder is an advanced penetration testing tool that acts as a fake SMB server to capture NTLMv2 credentials when a system attempts to authenticate.
Captures NTLMv2 hashes from authentication attempts.
Support for multiple protocols (SMB, HTTP, FTP, among others).
Ideal for testing this vulnerability.
Install responder on your attacking machine.
sudo apt update && sudo apt install responder
sudo responder -I <NETWORK_INTERFACE> -v
Or also using my script:
python3 captureHashResponder.py
Keep the server running and wait for victims to access the malicious file:// link sent.
[SMB] NTLMv2-SSP Client : 192.168.1.100
[SMB] NTLMv2-SSP Username : VICTIM-PC\user
[SMB] NTLMv2-SSP Hash : e5d5c82d3e44bf4...etc
Blocking the file:// Protocol:
Configure your email client to avoid links that use the file:// protocol.
Disable Automatic Submission of NTLM Credentials:
Open the Group Policy Editor.
Navigate to Security Settings > Local Policies > Security Options.
Configure Network Security: Restrict use of NTLM: Deny outgoing NTLM traffic to remote servers.
Security Update:
Apply the latest security patches provided by Microsoft.
Use of Strong Passwords and Multi-Factor Authentication (MFA):
This minimizes the impact if credentials are compromised.
This tool and included scripts are for educational purposes only and for testing in controlled environments with explicit permission. Misuse of these tools for malicious activities is illegal and subject to severe legal penalties.
This project is distributed under the MIT License. See the LICENSE file for details.
If you have questions or would like to collaborate, do not hesitate to contact me:
Author: d1se0
Mail: [email protected]