CVE-2024-21412_Water-Hydra

Deliver malware via CVE-2024-21412

usage

Start the services in order, then access the web server.

webserver

Start a web server in the folder: python -m http.server

• Initial Access: Use Windows Advanced Query Syntax (AQS) to link back to a JPEG trojan hosted on a WebDAV share.
• Initial Access: Use the search: protocol to customize a Windows Explorer window.
  • It uses the search: application protocol to perform a photo search.
  • It uses the crumb parameter to restrict the search scope to the malicious WebDAV share.
  • It uses the DisplayName element to deceive users into thinking it is the local Downloads folder.

samba-compose

Run docker compose up in the folder.

• Samba server using the crazymax/samba Docker image.

loader

Create a2.cmd and compress it into a2.zip, then place it in the samba-compose/pictures folder.

• Execution: Exploit CVE-2024-21412 (ZDI-CAN-23100) to bypass Microsoft Defender SmartScreen.

CVE-2024-21412 revolves around Internet Shortcut (.url) files. These .url files are simple INI configuration files that use the URL= parameter to point to a URL. Although the .url file format is not officially documented, the URL parameter is the only required parameter for this file type.