CVE-2024-38200
MEDIUMMicrosoft 365 Apps and Office - Exposure of Sensitive Information via Spoofing
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-38200. PoCs published by Metin Yunus Kandemir, passtheticket.
AI-analyzed exploit summary This exploit leverages Microsoft Office URI handlers to force NTLMv2 authentication over HTTP, allowing an attacker to capture and relay the hash to escalate privileges. It requires DNS manipulation and a malicious HTML page to trigger the vulnerability.
Description
Microsoft Office Spoofing Vulnerability
Exploits (2)
This exploit leverages Microsoft Office URI handlers to force NTLMv2 authentication over HTTP, allowing an attacker to capture and relay the hash to escalate privileges. It requires DNS manipulation and a malicious HTML page to trigger the vulnerability.
The repository contains a functional exploit for CVE-2024-38200, demonstrating how to capture NTLMv2 hashes over HTTP via Office URI schemes and relay them for privilege escalation. The `uncredirect.py` script handles HTTP redirection to UNC paths, bypassing security restrictions.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N