Wednesday, December 6, 2023

Hackers Can Steal Password Hashes & Crash Windows systems Automatically with Microsoft Outlook and OLE

The researcher discovered a flaw that combined with Microsoft Outlook and OLE which leads to steal the Password hash and eventually crash the windows system.

OLE (Object Linking and Embedding) is a component document technology created by Microsoft that helps to dynamically link files and applications together.

Microsoft Outlook is an email client that comes with Microsoft Office. Outlook includes the ability to send rich text (RTF) email messages.

We can see the rich text Email messages when we open it with Microsoft outlook client.

HTML Email messages are a common rich text file and when we open it with Microsoft outlook client it will not load automatically since it belongs to HTML message that has a remote image on a web server.

Because it could leak the client system’s IP address and other metadata such as the time that an email is viewed if Outlook allowed remote images to load automatically.

But same remote Image retrieved by SMB server via RTF Email message and OLE Document has been loaded and rendered the images successfully.

According to Researcher, this is unexpected. Outlook blocks remote web content due to the privacy risk of web bugs. But with a rich text email, the OLE object is loaded with no user interaction.

Traffic Capture and Stealing Password Hash

We analyse the web traffic when the document loading after it being shared remotely and to see what kind of information it leaks.

“Here we can see that an SMB connection is being automatically negotiated. The only action that triggers this negotiation is Outlook previewing an email that is sent to it.”

In this case researcher find that following data are leaked due to OLE Web Bug:

  1. IP address
  2. Domain name
  3. User name
  4. Host name
  5. SMB session key

Aslo this outlook bug initiates an SMB(Server Message Block) connection to an arbitrary host. An SMB flaw that has been disclosed on February 1, 2017

Upon connecting to a malicious SMB server, Windows would crash, in this case, user create a rich text email in Outlook, but point to an SMB server that exploits this vulnerability.

Later hash will be cracked using a tool called John the Ripper, and it reveals the password for the user “test_user”.

it was reported to Microsoft and released a fix for the issue of Outlook automatically loading remote OLE content (CVE-2018-0950).


Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles