CVE-2024-43532 Exploitation of the bug allows the client's NTLM authentication data to be intercepted and redirected to Active Directory Certificate Services (ADCS), which allows hackers to request a user certificate for further authentication to the domain. As a result, new privileged accounts can be created at the domain level, which opens up the possibility of long-term control over the system.
- CVE ID: CVE-2024-43532
- Published: 2024-10-08
- Impact: Confidentiality
- Exploit Availability: Not public, only private.
- CVSS: 8.8
The problem is related to the BaseBindToMachine function in advapi32.dll. In some cases, the function uses the insecure authentication level RPC_C_AUTHN_LEVEL_CONNECT, which allows attackers to perform a Machine-in-the-Middle attack. If the underlying SMB transport is unavailable, the client switches to TCP/IP and other protocols, which opens the door to interception of data and execution of an attack.
Windows 10/11, Windows Server 2008-2022
To run exploit you need Python 3.9. Execute:
python exploit.py -h 10.10.10.10 -c 'uname -a'For inquiries, please contact hazelook@exploit.in