🖼️ Manipulating Shim and Office for Code Injection

Office Injector - Invokes an RPC method in OfficeClickToRun service that will inject a DLL into a suspended process running as NT AUTHORITY\SYSTEM launched by the task scheduler service, thus achieving privilege escalation from administrator to SYSTEM.

Shim Injector - Writes an undocumented shim data structure into the memory of another process that causes apphelp.dll to apply the “Inject Dll” fix on the process without registering a new SDB file on the system, or even writing such file to disk.

DefCon Presentation

🔗 Source:
https://github.com/deepinstinct/ShimMe

#windows #office #rpc #inject #lpe

💻 Microsoft Office NTLMv2 Disclosure (CVE-2024-38200)

A new vulnerability related to capturing NTLMv2 hashes via Office URI schemes has been discovered. The http:// protocol can be used for attacks such as NTLM relay to a Domain Controller.

Microsoft 365 and Office 2019 versions are vulnerable, as they open remote files without warnings, unlike earlier versions. The exploit involves using a 302 redirect and abusing GPO misconfigurations to capture NTLMv2 hashes over SMB and HTTP.

🔗 Source:
https://github.com/passtheticket/CVE-2024-38200

#windows #office #ntlm #relay