Andrea Pierini

A use after free issue exists in Windows Print Spooler Components. This allows an authorized attacker to execute code over a network.

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. An authenticated low-privileged user can gain the rights of the account running the Windows Admin Center service. Because Windows Admin Center serves as a centralized control plane for managing servers, clusters, and Active Directory-joined systems, this flaw could potentially lead to full domain compromise under certain conditions.

Name of the Vulnerable Software and Affected Versions Windows versions (affected versions not specified) Description A flaw in Windows HTTP.sys related to improper access control can allow an authorized attacker to elevate privileges over a network. This issue can be exploited remotely. The vulnerability enables Kerberos authentication relay to Active Directory Certificate Services (AD CS) via DNS CNAME abuse, bypassing NTLM protections. A proof-of-concept (PoC) has been released demonstrating how attackers can manipulate DNS CNAME resolution to coerce Windows clients into requesting Kerberos tickets for attacker-controlled Service Principal Names (SPNs), enabling credential relay and lateral movement. This poses a risk to Active Directory networks, even when NTLM is disabled. Mitigation means removing relay opportunities at the service layer. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Windows File Explorer is affected by a privilege escalation issue, which allows attackers to gain access to a user's NetNTLM hash from any session on the computer, even with low-privileged user rights. This issue is related to unnecessary permissions being set in Access Security when explorer.exe is running at a High Integrity Level. The issue is exploited by bypassing security controls using cross-session activation of the ShellWindows DCOM application. Vulnerable software: Windows File Explorer Vulnerable versions: Not specified, but patched in KB5040434 Exploit is available at: https://github.com/MzHmO/LeakedWallpaper and https://github.com/Florian-Hoth/CVE-2024-38100-RCE-POC #WindowsFileExplorer #ElevationOfPrivilege #LeakedWallpaper #DCOM #LocalPrivilegeEscalation #Micropatches #KB5040434 #FakePotato #ShellWindows

The issue is related to the implementation of the NT LAN Manager (NTLM) protocol in Windows operating systems, which is associated with insufficient access restrictions. Exploitation of this issue may allow an attacker to bypass security restrictions and elevate their privileges. The vulnerability allows for arbitrary file read/write and elevation of privilege. It is a type of NTLM reflection attack that targets local authentication.

The issue allows a user to gain access to protected parts of the file system due to inadequate permissions logic.