CVE-2014-1812
HIGH KEV RANSOMWAREMicrosoft Windows - Privilege Escalation
Title source: llmExploitation Summary
CVE-2014-1812 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.
EIP tracks 2 public exploits from researchers including mauricelambert, including a Metasploit module auxiliary/scanner/smb/smb_enum_gpp.
AI-analyzed exploit summary This script encrypts passwords to the Group Policy Preferences (GPP) cpassword format, which is vulnerable to decryption due to a hardcoded AES key. It is useful for creating vulnerable lab environments to test CVE-2014-1812.
Description
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."
Exploits (2)
This script encrypts passwords to the Group Policy Preferences (GPP) cpassword format, which is vulnerable to decryption due to a hardcoded AES key. It is useful for creating vulnerable lab environments to test CVE-2014-1812.
This Metasploit module enumerates SMB shares for Group Policy Preference XML files containing encrypted credentials, which it decrypts using Microsoft's public AES key. It is designed to extract and report user credentials from vulnerable domain controllers.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H