CVE-2024-21413 – Microsoft Outlook Moniker Link Vulnerability

---

Overview

This repository documents my hands-on analysis of CVE-2024-21413 (Moniker Link), a critical Microsoft Outlook vulnerability that bypasses Protected View to leak Windows NetNTLMv2 credentials via SMB authentication.

Severity: Critical (CVSS 9.8)

---

Learning Objectives

• Understand Moniker Links
• Learn how Outlook Protected View works
• Analyze CVE-2024-21413
• Capture NTLM credentials
• Detect malicious emails
• Apply mitigation strategies

---

Vulnerability Details

Field	Value
CVE	CVE-2024-21413
Published	13 February 2024
Vendor	Microsoft
Severity	Critical
CVSS	9.8
Impact	Credential Leak & Potential RCE
Attack Complexity	Low

---

Attack Flow

Attacker
    │
    ▼
Malicious HTML Email
    │
    ▼
Victim Clicks Moniker Link
    │
    ▼
Protected View Bypass
    │
    ▼
SMB Authentication
    │
    ▼
Responder
    │
    ▼
NetNTLMv2 Hash Captured

---

Lab Environment

• TryHackMe AttackBox
• Vulnerable Windows Machine
• Microsoft Outlook
• Python PoC
• Responder
• Wireshark

---

Exploitation Steps

1. Configure Python PoC
2. Modify attacker IP
3. Configure SMTP server
4. Start Responder
5. Send malicious email
6. Victim clicks Moniker Link
7. SMB authentication occurs
8. NetNTLMv2 hash captured

---

Detection

YARA

Detects:

• file://
• Suspicious HTML hyperlinks
• Moniker Link exploitation attempts

Network Detection

• SMB authentication requests
• Unexpected outbound SMB traffic
• NetNTLMv2 authentication events

Tools

• YARA
• Wireshark
• Responder

---

Mitigation

• Install Microsoft February 2024 security updates
• Keep Office updated
• Educate users against phishing
• Verify hyperlinks before clicking
• Monitor SMB traffic
• Restrict outbound SMB where appropriate

---

Skills Learned

• Vulnerability Analysis
• Outlook Security
• Email Security
• NTLM Authentication
• Credential Theft
• SMB Protocol
• Responder
• YARA Detection
• Wireshark Analysis
• Incident Detection

---

Key Takeaways

• Outlook Protected View can be bypassed.
• Moniker Links abuse Windows COM functionality.
• SMB authentication leaks NetNTLMv2 hashes.
• Patch management is the most effective defense.
• Detection requires both endpoint and network monitoring.

---

References

• Microsoft Security Advisory
• Check Point Research
• TryHackMe – Moniker Link (CVE-2024-21413)

---

⭐ If you found this repository useful, feel free to star it and connect with me on LinkedIn as I continue documenting my cybersecurity learning journey.