Exploiting Outlook CVE-2023-23397 to Relay Credentials

[@MikeClark7]

This is awesome, thank you for sharing this. I really liked how you showed the event logs and what to look for. I was able to take this back to work to start creating a detection.

[@CyberAttackDefense]

Where I can I will always show some level of detection. Purple is the way forward! Thanks for watching!

[@MariosKampolis]

Thank you very much for your content, I am really enjoying the way you convey the information and the fact that you make the extra step of showing how to detect these common techniques and toolsets is very eye-opening. A question(or clarification) about detecting Pass-The-Cert attack. The fields of the event we need to effectively detect this attack are the event code, the certificate issuer name and the account name of a user? Additionally, I think we can catch this attack from the Ticket options field revealing the tool used. Thank you again for your effort creating such content of high quality

[@CyberAttackDefense]

Correct the fields you need are the event code 4768, the fact that the certificate issuer name exists means its certificate based authentication. You might be able to look in the options of event id 4778 to find the tool but that isn’t always accurate.

[@thewifiaddict]

Found your channel on linkedin, and loving your content!

[@CyberAttackDefense]

Really? I don’t even publish my content to LinkedIn. I guess word is getting around! Thanks for watching!

[@Hacsev]

So do I run the send function inside of the organization? Or can it be done externally plus a listener inside the organization? Also, the method you showed can only be run on an already compromised windows host, correct?

[@CyberAttackDefense]

Listener has to be inside the org for SMB if you use WebDAV it can be anywhere but you won’t be able to relay. That method requires Outlook so an assume breach scenario

[@Hacsev]

@@CyberAttackDefense Thanks. Also, where can I find your donut video? I really need to watch it again as I am currently facing CS falcon.

[@CyberAttackDefense]

@@Hacsev DM me

[@Hacsev]

@@CyberAttackDefense I think YT removed that feature. Can you briefly post the unlisted video link and then remove the comment?

[@CyberAttackDefense]

@@Hacsev @bripwn on twitter

[@deAnanasM-ed3tp]

Have you tried the send function as well? I only get the hashes of the sender and not the receiver when I use this. The reminder does pop up on the receivers end but no hashes are sent :( The ntlm listener is reachable bcs when I go to its unc path on the victim machine I do get the hashes

[@CyberAttackDefense]

I ran into this on some versions of outlook. Others it did work. Also some mail providers and EDR vendors are knocking this out.

[@KareenLevis]

please make a video How to Create Custom Phishlets in Evilginx2?

[@CyberAttackDefense]

Ok great idea!