Saturday, May 18, 2024

Hackers Can Steal Password Hashes & Crash Windows systems Automatically with Microsoft Outlook and OLE

The researcher discovered a flaw that combined with Microsoft Outlook and OLE which leads to steal the Password hash and eventually crash the windows system.

OLE (Object Linking and Embedding) is a component document technology created by Microsoft that helps to dynamically link files and applications together.

Microsoft Outlook is an email client that comes with Microsoft Office. Outlook includes the ability to send rich text (RTF) email messages.

We can see the rich text Email messages when we open it with Microsoft outlook client.

HTML Email messages are a common rich text file and when we open it with Microsoft outlook client it will not load automatically since it belongs to HTML message that has a remote image on a web server.

Because it could leak the client system’s IP address and other metadata such as the time that an email is viewed if Outlook allowed remote images to load automatically.

But same remote Image retrieved by SMB server via RTF Email message and OLE Document has been loaded and rendered the images successfully.

According to Researcher, this is unexpected. Outlook blocks remote web content due to the privacy risk of web bugs. But with a rich text email, the OLE object is loaded with no user interaction.

Traffic Capture and Stealing Password Hash

We analyse the web traffic when the document loading after it being shared remotely and to see what kind of information it leaks.

“Here we can see that an SMB connection is being automatically negotiated. The only action that triggers this negotiation is Outlook previewing an email that is sent to it.”

In this case researcher find that following data are leaked due to OLE Web Bug:

  1. IP address
  2. Domain name
  3. User name
  4. Host name
  5. SMB session key

Aslo this outlook bug initiates an SMB(Server Message Block) connection to an arbitrary host. An SMB flaw that has been disclosed on February 1, 2017

Upon connecting to a malicious SMB server, Windows would crash, in this case, user create a rich text email in Outlook, but point to an SMB server that exploits this vulnerability.

Later hash will be cracked using a tool called John the Ripper, and it reveals the password for the user “test_user”.

it was reported to Microsoft and released a fix for the issue of Outlook automatically loading remote OLE content (CVE-2018-0950).


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles