Andrea Pierini

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** A use after free issue exists in Windows Print Spooler Components. This allows an authorized attacker to execute code over a network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Admin Center versions prior to 2511 **Description** Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. An authenticated low-privileged user can gain the rights of the account running the Windows Admin Center service. Because Windows Admin Center serves as a centralized control plane for managing servers, clusters, and Active Directory-joined systems, this flaw could potentially lead to full domain compromise under certain conditions. **Recommendations** Update Windows Admin Center to version 2511.

Name of the Vulnerable Software and Affected Versions Windows versions (affected versions not specified) Description A flaw in Windows HTTP.sys related to improper access control can allow an authorized attacker to elevate privileges over a network. This issue can be exploited remotely. The vulnerability enables Kerberos authentication relay to Active Directory Certificate Services (AD CS) via DNS CNAME abuse, bypassing NTLM protections. A proof-of-concept (PoC) has been released demonstrating how attackers can manipulate DNS CNAME resolution to coerce Windows clients into requesting Kerberos tickets for attacker-controlled Service Principal Names (SPNs), enabling credential relay and lateral movement. This poses a risk to Active Directory networks, even when NTLM is disabled. Mitigation means removing relay opportunities at the service layer. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Windows File Explorer is affected by a privilege escalation issue, which allows attackers to gain access to a user's NetNTLM hash from any session on the computer, even with low-privileged user rights. This issue is related to unnecessary permissions being set in Access Security when explorer.exe is running at a High Integrity Level. The issue is exploited by bypassing security controls using cross-session activation of the ShellWindows DCOM application. Vulnerable software: Windows File Explorer Vulnerable versions: Not specified, but patched in KB5040434 Exploit is available at: https://github.com/MzHmO/LeakedWallpaper and https://github.com/Florian-Hoth/CVE-2024-38100-RCE-POC #WindowsFileExplorer #ElevationOfPrivilege #LeakedWallpaper #DCOM #LocalPrivilegeEscalation #Micropatches #KB5040434 #FakePotato #ShellWindows

**Name of the Vulnerable Software and Affected Versions** Windows versions prior to the January 2023 Patch Tuesday **Description** The issue is related to the implementation of the NT LAN Manager (NTLM) protocol in Windows operating systems, which is associated with insufficient access restrictions. Exploitation of this issue may allow an attacker to bypass security restrictions and elevate their privileges. The vulnerability allows for arbitrary file read/write and elevation of privilege. It is a type of NTLM reflection attack that targets local authentication. **Recommendations** As a temporary workaround, consider disabling the NTLM protocol until a patch is available. Restrict access to the vulnerable NTLM service to minimize the risk of exploitation. Apply the January 2023 Patch Tuesday updates to resolve the issue. If you are running a version of Windows that is not patched, avoid using the NTLM protocol for authentication.

**Name of the Vulnerable Software and Affected Versions** iTunes for Windows versions prior to 12.10.4 **Description** The issue allows a user to gain access to protected parts of the file system due to inadequate permissions logic. **Recommendations** For versions prior to 12.10.4, update to iTunes for Windows 12.10.4 to resolve the issue.