Thursday, March 28, 2024

Hackers Can Steal Password Hashes & Crash Windows systems Automatically with Microsoft Outlook and OLE

The researcher discovered a flaw that combined with Microsoft Outlook and OLE which leads to steal the Password hash and eventually crash the windows system.

OLE (Object Linking and Embedding) is a component document technology created by Microsoft that helps to dynamically link files and applications together.

Microsoft Outlook is an email client that comes with Microsoft Office. Outlook includes the ability to send rich text (RTF) email messages.

We can see the rich text Email messages when we open it with Microsoft outlook client.

HTML Email messages are a common rich text file and when we open it with Microsoft outlook client it will not load automatically since it belongs to HTML message that has a remote image on a web server.

Because it could leak the client system’s IP address and other metadata such as the time that an email is viewed if Outlook allowed remote images to load automatically.

But same remote Image retrieved by SMB server via RTF Email message and OLE Document has been loaded and rendered the images successfully.

According to Researcher, this is unexpected. Outlook blocks remote web content due to the privacy risk of web bugs. But with a rich text email, the OLE object is loaded with no user interaction.

Traffic Capture and Stealing Password Hash

We analyse the web traffic when the document loading after it being shared remotely and to see what kind of information it leaks.

“Here we can see that an SMB connection is being automatically negotiated. The only action that triggers this negotiation is Outlook previewing an email that is sent to it.”

In this case researcher find that following data are leaked due to OLE Web Bug:

  1. IP address
  2. Domain name
  3. User name
  4. Host name
  5. SMB session key

Aslo this outlook bug initiates an SMB(Server Message Block) connection to an arbitrary host. An SMB flaw that has been disclosed on February 1, 2017

Upon connecting to a malicious SMB server, Windows would crash, in this case, user create a rich text email in Outlook, but point to an SMB server that exploits this vulnerability.

Later hash will be cracked using a tool called John the Ripper, and it reveals the password for the user “test_user”.

it was reported to Microsoft and released a fix for the issue of Outlook automatically loading remote OLE content (CVE-2018-0950).

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles