CVE-2024-21413 — Outlook Moniker Link (Lab / PoC)

Educational lab notes and a small Proof of Concept (PoC) demonstrating the CVE-2024-21413 attack flow in a controlled environment (TryHackMe-style lab).

⚠️ For educational purposes only. Do not use against systems you don’t own or have explicit permission to test.

---

Overview

Microsoft Outlook can render HTML emails and handle different URL schemes. This lab explores how a crafted Moniker Link using the file:// scheme and a special character (!) can bypass Outlook's Protected View behavior and trigger an SMB authentication attempt, potentially leaking the victim’s netNTLMv2 hash.

---

What I Practiced

• Crafting an HTML email containing a malicious file:// Moniker Link
• Understanding the ! character behavior in the Moniker Link
• Sending HTML emails using Python (SMTP)
• Capturing netNTLMv2 hashes using Responder
• High-level detection & mitigation discussion

---