Password hash  - Password hash - Hackers Can Steal Password Hash with Microsoft Outlook and OLE

The researcher discovered a flaw that combined with and which leads to the hash and eventually crash the windows system.

OLE (Object Linking and Embedding) is a component document created by Microsoft that helps to dynamically link files and applications together.

Microsoft Outlook is an email client that comes with Microsoft Office. Outlook includes the ability to send rich text (RTF) email messages.

- outlook insert object - Hackers Can Steal Password Hash with Microsoft Outlook and OLEWe can see the rich text Email messages when we open it with Microsoft outlook client.

HTML Email messages are a common rich text file and when we open it with Microsoft outlook client it will not load automatically since it belongs to HTML message that has a remote image on a web server.

- html message annotated - Hackers Can Steal Password Hash with Microsoft Outlook and OLE

Because it could leak the client system’s IP address and other metadata such as the time that an email is viewed if Outlook allowed remote images to load automatically.

But same remote Image retrieved by SMB server via RTF Email message and OLE Document has been loaded and rendered the images successfully.

 

- rtf message annotated - Hackers Can Steal Password Hash with Microsoft Outlook and OLE

According to Researcher, this is unexpected. Outlook blocks remote web content due to the privacy risk of web bugs. But with a rich text email, the OLE object is loaded with no user interaction.

Traffic Capture and Stealing Password Hash

We analyse the web traffic when the document loading after it being shared remotely and to see what kind of information it leaks.

“Here we can see that an SMB connection is being automatically negotiated. The only action that triggers this negotiation is Outlook previewing an email that is sent to it.”

- wireshark annotated - Hackers Can Steal Password Hash with Microsoft Outlook and OLE

In this case researcher find that following are leaked due to OLE Web Bug:

  1. IP address
  2. Domain name
  3. User name
  4. Host name
  5. SMB session key

Aslo this outlook bug initiates an SMB(Server Message Block) connection to an arbitrary host. An SMB flaw that has been disclosed on February 1, 2017

Upon connecting to a malicious SMB server, Windows would crash, in this case, user create a rich text email in Outlook, but point to an SMB server that exploits this vulnerability.

Later hash will be cracked using a tool called John the Ripper, and it reveals the password for the user “test_user”.

it was reported to Microsoft and released a fix for the issue of Outlook automatically loading remote OLE content (CVE-2018-0950).



Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here