securenetexpert/cve-2024-21413-moniker-link-writeupTechnical write-up on CVE-2024-21413 (Moniker Link vulnerability)
This repository contains a technical write-up of CVE-2024-21413, a vulnerability related to the handling of Moniker Links in Microsoft Outlook that allows attackers to bypass Protected View and leak NTLMv2 credentials through user interaction.
The lab was completed on TryHackMe, and this write-up focuses on explaining the attack flow, impact, and security lessons learned.
This vulnerability abuses the way Outlook processes Moniker Links, allowing an attacker-controlled remote resource to be accessed without proper security checks.
The attack starts with the delivery of a malicious email containing a crafted Moniker Link. When opened in Outlook, the email appears legitimate and does not trigger Protected View warnings.
Once the victim clicks the link, Outlook attempts to access a remote resource controlled by the attacker. During this process, the victim’s machine automatically sends NTLMv2 authentication data over SMB.
The email delivery exploit used during the lab is based on the following public proof of concept:
(The exploit code itself was not modified and is therefore not fully reproduced here.)
Although the exploitation process is simple, the impact is significant.
An attacker can:
This vulnerability demonstrates how a single user interaction can lead to credential exposure and further attack opportunities.
