MonikerLink

Repository contains one substantive code file, TRUST_v7_5.py, plus supporting documentation (README, TECHNICAL, SECURITY, CREDITS, LICENSE). The Python script is an interactive phishing campaign framework built around CVE-2024-21413 (Moniker Link). Its core purpose is to generate and send customized HTML emails containing a crafted file:// UNC hyperlink that points to an operator-controlled host/share/exploit path. When opened in vulnerable Outlook contexts, the link is intended to trigger outbound SMB authentication, typically for credential/hash capture via separate SMB listener infrastructure. Code structure described in the docs and visible in the script includes: terminal UI helpers (ANSI colors, boxed output), input validation for email/IP/port values, target loading from direct input or a text file, a Config dataclass for campaign settings, HTML payload generation, MIME email construction, SMTP delivery with STARTTLS support and exponential backoff retry logic, and a main loop that sends per-target emails with campaign result reporting. The script is stateless and does not itself capture credentials; instead it delivers the lure and relies on external SMB tooling/listeners. Main exploit capabilities: multi-target phishing delivery, customizable sender/subject/body pretext, customizable UNC host/share/exploit names to reduce obvious signatures, SMTP-authenticated sending, retry logic, and per-target success/failure reporting. This is not a detector or scanner; it is an operational phishing delivery tool for exploiting a known Outlook-related behavior. Based on the included payload generation and delivery logic, the repository is a real exploit framework/PoC extension rather than a fake or documentation-only project.

This repository is a small proof-of-concept for CVE-2024-21413 targeting Microsoft Outlook. It contains one Python exploit script and a README. The Python file, CVE-2024-21413.py, is the main entry point and uses Python's smtplib plus MIME helpers to authenticate to a user-specified SMTP server and send an HTML email to a chosen recipient. The email body embeds a clickable hyperlink in the form file:///{link_url}!poc, along with a large inline base64 PNG image used as visual content. The exploit capability is limited to delivery: it does not run an SMB server, capture hashes, crack credentials, or execute commands on the victim. Instead, it automates sending a crafted message intended to abuse Outlook's handling of file:// links so the victim client reaches out to an attacker-controlled SMB path. The README explains the intended post-delivery effect: Outlook may initiate SMB authentication to the attacker host, leaking NetNTLMv2 credentials that could then be relayed or cracked externally. Structurally, the script has a banner function, a send_email function that builds multipart plain-text/HTML content and sends it over STARTTLS-authenticated SMTP, and a main function that parses CLI arguments for SMTP server, port, credentials, sender, recipient, malicious URL path, and subject. Overall, this is a genuine PoC email-delivery exploit for credential leakage via Outlook, not a full end-to-end weaponized exploit.

This repository is a small Python proof-of-concept exploit for CVE-2024-21413 (Moniker Link–style Outlook attack). It contains only two files: a brief README with operator steps and a single script, exploit.py. The script uses Python's smtplib and email MIME libraries to authenticate to an SMTP server and send a crafted HTML email to a chosen recipient. The email body embeds a file:// URI (file://ATTACKER_MACHINE/test!exploit), intended to reference an attacker-controlled host/resource. The stated operational goal in the README is to capture the victim's hash in Responder after the victim interacts with the message, indicating credential leakage/NTLM capture rather than direct code execution. Repository structure and purpose: - README.md: Minimal usage instructions. It describes preparing network access, using Remmina/RDP, editing placeholders in exploit.py, starting Responder, sending the email, and checking for captured user hashes. - exploit.py: Main exploit entry point. Hardcoded placeholders are used for sender_email, receiver_email, attacker SMTP password prompt, SMTP server hostname/IP, and the attacker UNC/file host in the HTML link. Main exploit capabilities: - Crafts an HTML phishing email with a malicious file:// link. - Authenticates to a specified SMTP server on TCP/25. - Sends the lure email to a target recipient. - Supports credential-harvest workflow by directing victim access toward an attacker-controlled host, where NTLM challenge-response material may be captured. This is a real exploit PoC rather than a detector. It is operational but basic: the payload and infrastructure values are hardcoded placeholders and require manual editing. No advanced evasion, automation, or post-exploitation logic is present.

This repository is a small standalone Python proof-of-concept for CVE-2024-21413 affecting Microsoft Outlook. It contains one executable script, CVE-2024-21413.py, and a README with usage instructions and screenshots. The Python script does not exploit Outlook directly over the network; instead, it weaponizes email delivery by authenticating to an SMTP server, building a multipart/plain+HTML message, and embedding a crafted file:/// hyperlink in the HTML body: file:///{link_url}!poc. The operator supplies the SMTP server, credentials, sender/recipient addresses, subject, and malicious path at runtime. Main capability: delivery of a crafted phishing-style email intended to trigger Outlook's vulnerable moniker link handling. The exploit can support NTLM credential leakage and potentially 1-click RCE scenarios depending on what path/resource is supplied in --url and how the target Outlook/Windows environment handles the referenced resource. The script includes STARTTLS and SMTP login, making it more operational than a bare PoC because it can send realistic authenticated messages through a mail server. Repository structure is minimal: the Python file contains banner display, argument parsing, and a send_email function that constructs and sends the malicious message; the README documents the vulnerability, command-line usage, screenshots, and claimed outcomes. No listener, SMB/WebDAV server, payload hosting logic, or post-exploitation code is included, so the repository is focused on initial delivery rather than full end-to-end exploitation infrastructure.

This repository is a small proof-of-concept/lab exploit package for CVE-2024-21413, the Microsoft Outlook Moniker Link vulnerability. It contains three files: a README with step-by-step TryHackMe lab instructions, a Python exploit script, and an OpenVPN configuration file for accessing the lab environment. The core exploit logic is entirely in exploit.py. The Python script uses the standard smtplib and email MIME libraries to authenticate to an SMTP server on port 25 and send a crafted HTML email. The email body contains a file:// URI pointing to an attacker-controlled host and path (file://ATTACKER_MACHINE_IP_ADDRESS/test!exploit). The intended effect is that when the victim interacts with the message/link in Outlook, the client attempts remote file access and leaks NTLM authentication material to the attacker-controlled system, where tools like Responder can capture the NTLMv2 hash. This is credential capture/coercion rather than direct code execution. Repository structure and purpose: - README.md: walkthrough for reproducing the issue in a TryHackMe room, including VPN setup, RDP access, Responder usage, and post-capture cracking guidance. - exploit.py: main exploit entry point; sends the malicious email after the operator fills in placeholders for SMTP server, sender, recipient, and attacker IP. - kartheekkandalam.ovpn: VPN profile for the lab. Not part of exploit logic, but highly sensitive because it includes a remote VPN endpoint, certificate material, and a private key. Notable findings: - The exploit is operational but basic: it has hardcoded placeholders and no automation for listener setup or payload customization beyond manual edits. - It targets Outlook users in a controlled lab and relies on user interaction plus reachable attacker infrastructure. - The included .ovpn file exposes sensitive VPN credentials/private key material and should be treated as compromised secret data.

This repository is a small standalone PoC and educational write-up for CVE-2024-21413 ('Moniker Link') affecting Microsoft Outlook on Windows. It contains 5 files: one Python exploit script (exploit.py), one HTML attack-flow diagram, and three Markdown documents covering overview, mitigation, and CVE details. The only executable exploit logic is in exploit.py. The Python script is a phishing delivery PoC. It accepts sender, recipient, SMTP server, SMTP port, attacker IP, and SMB share name as arguments; builds a malicious Outlook moniker URL in the form file:///\\<attacker_ip>\<share>\!exploit; embeds that link into both plaintext and HTML email bodies; and sends the message via SMTP using Python's smtplib. The exploit does not itself host SMB, capture hashes, or execute code on the victim. Instead, it relies on external infrastructure such as Responder on the attacker host to receive the victim's outbound SMB authentication and capture NTLM material. Main exploit capability: delivery of a crafted email that, when clicked by a user in vulnerable Outlook, causes the victim machine to initiate SMB authentication to an attacker-controlled UNC path. This enables NTLM credential leakage/forced authentication. Although the repository documentation repeatedly mentions RCE as part of the CVE impact, the implemented code only demonstrates the credential-leak vector and social-engineering delivery path, not a full remote-code-execution chain or post-exploitation payload. Repository structure and purpose: - exploit.py: primary PoC; argument parsing, malicious link generation, MIME email construction, SMTP sending. - README.md: usage instructions, lab setup, attack explanation, and references. - MITIGACAO.md: defensive guidance, patching, firewall/NTLM recommendations, and monitoring ideas. - CVE-BREAKDOWN.md: detailed technical explanation of the vulnerability and affected versions. - diagrama-ataque.html: interactive visualization of the attack stages. Overall, this is a real but basic operational PoC for email-based exploitation delivery of CVE-2024-21413 in lab conditions, centered on NTLM hash leakage via SMB rather than a weaponized or customizable exploitation framework.

Repository purpose: a Python proof-of-concept for CVE-2024-21413 (Microsoft Outlook MonikerLink / file:// handling) focused on delivering a crafted HTML email and capturing coerced NTLM authentication via SMB. Structure: - CVE-2024-21413.py: interactive script that (1) collects SMTP settings and message parameters, (2) loads an HTML template and replaces placeholders (date/time, random IP, recipient email, attacker-supplied {url}), (3) sends the email via SMTP with STARTTLS, and (4) optionally starts an Impacket SMB server and parses its output to extract an NTLMv2 hash-like string. - Templates/*.html: two phishing-style Microsoft-themed templates embedding the key payload link: file:///{url}!Account. - README.md: describes usage and claims features (notably mentions an RTF attachment creation, but the provided code does not actually generate/attach an exploit.rtf). Exploit capabilities: - Phishing delivery over SMTP (attacker provides SMTP host/port/credentials). - Payload is the file:// link in HTML intended to trigger outbound access to an attacker-controlled SMB endpoint, enabling NTLM hash capture (credential coercion). The script then runs impacket-smbserver (share name "test" rooted at /tmp) and attempts to regex-extract an NTLM hash from the server output. Notable observations/limitations: - Requires root (enforced) to run the SMB server. - The script installs impacket via pip if missing. - No hardcoded C2 domains/IPs; the primary target endpoint is user-supplied via the {url} placeholder (commonly a UNC path/host).

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-21413, a vulnerability in Microsoft Outlook that allows remote code execution or credential theft via a crafted 'file://' link in an email. The repository contains four files: a Python exploit script (exploit.py), a README.md with detailed usage and lab setup instructions, a LICENSE, and a .gitattributes file. The main exploit is implemented in 'exploit.py', which sends a malicious HTML email from 'attacker@monikerlink.thm' to 'victim@monikerlink.thm' via SMTP. The email contains a 'file://' link pointing to 'ATTACKER_IP', which, when processed by a vulnerable Outlook client, causes the client to attempt to access the attacker's SMB server, potentially leaking NTLM credentials. The exploit is designed for a controlled lab environment and requires manual configuration of email addresses, server IPs, and credentials. No advanced payload or post-exploitation is included; the PoC demonstrates the initial attack vector and credential leak mechanism.

This repository contains a proof-of-concept exploit for CVE-2024-21413, a critical vulnerability in Microsoft Outlook that allows attackers to leak NTLM credentials via a crafted Moniker Link. The repository consists of a detailed README.md explaining the vulnerability, affected products, and exploitation steps, and a Python script (exploit.py) that automates sending a malicious email to a victim. The script constructs an HTML email containing a specially crafted 'file://' Moniker Link with a '!' character, which bypasses Outlook's Protected View and causes the victim's Outlook client to attempt an SMB connection to the attacker's machine, leaking the victim's netNTLMv2 hash. The exploit requires the attacker to set up an SMTP server and an SMB listener to capture the credentials. No RCE payload is included; the exploit is focused on credential theft via NTLM hash leakage.

This repository is a proof-of-concept (PoC) exploit for CVE-2024-21413, a vulnerability in Microsoft Outlook that allows remote code execution or credential theft via specially crafted file:// links. The repository contains two files: a README.md with detailed setup and usage instructions, and exploit.py, a Python script that sends an HTML email to a victim. The email contains a file:// link pointing to an attacker-controlled SMB share. When the victim opens the email in Outlook and clicks the link, Outlook attempts to authenticate to the SMB share, leaking the victim's NetNTLMv2 hash. The attacker can capture this hash using tools like Responder and attempt to crack it offline. The exploit demonstrates the risk of Outlook's handling of moniker/file links and provides guidance for detection and mitigation. The code is a straightforward PoC and does not include weaponized or automated payload delivery beyond credential theft via SMB authentication.

This repository is a proof-of-concept exploit for CVE-2024-21413, a vulnerability in Microsoft Outlook that can lead to NTLM hash leakage via malicious UNC links. The repository contains three main Python scripts: 1. src/exploit.py: Sends a crafted email with a malicious UNC link (file://[IP-ATACANTE]/test!exploit) to the victim using an attacker-controlled SMTP server. The intention is that when the victim clicks the link in Outlook, the client will attempt to authenticate to the attacker's SMB server, leaking the NTLM hash. 2. src/server-pop3.py: Implements a simple POP3 server that serves the malicious email to the victim's Outlook client. It reads the email from /tmp/email.eml. 3. src/servidor-smtp.py: Implements a simple SMTP server that receives emails and saves them to /tmp/email.eml for the POP3 server to serve. The README provides detailed setup instructions, including the use of virtual machines for both attacker and victim, and describes the intended attack flow. The exploit requires the victim's Outlook to be configured to use the attacker's SMTP and POP3 servers. The actual NTLM hash capture depends on the victim clicking the malicious link and the Outlook client attempting an SMB connection to the attacker's server. In the author's tests, the final hash capture step was unsuccessful, possibly due to environmental factors, but the infrastructure and exploit logic are sound for demonstrating the vulnerability. No hardcoded real IPs or domains are present; placeholders like [IP-ATACANTE] and [IP-SERVER-SMTP] are used. The main fingerprintable endpoints are the file path /tmp/email.eml and the UNC link format file://[IP-ATACANTE]/test!exploit. The exploit is educational and not weaponized, serving as a practical lab for understanding the vulnerability and attack chain.

This repository provides a practical exploit and lab environment for CVE-2024-21413, a critical vulnerability in Microsoft Outlook on Windows. The exploit leverages the file:// protocol in a crafted email to force the victim's Outlook client to connect to an attacker-controlled SMB share, resulting in the exposure of NTLMv2 credentials. The repository includes: - 'exploitSendEmailOutlook.py': A Python script that automates sending a malicious email with a file:// link to a victim via a specified SMTP server. The attacker provides sender and recipient credentials and the SMTP server IP. - 'captureHashResponder.py': A Python wrapper to launch the Responder tool, which listens for incoming SMB authentication attempts and captures NTLM hashes. - 'startServicesWindowsPack/startServicesWindows.py': A helper script to automate starting hMailServer and Outlook in the lab environment. - 'README.md': Detailed instructions for setting up the lab, using the exploit, and capturing hashes, as well as mitigation advice. - 'LAB-CVE-2024-21413/WindowsOutlookVulnIMG-VMWare/downloadLab.md': A link to download a pre-configured lab environment. The exploit is operational and intended for educational and testing purposes in a controlled environment. It demonstrates a real-world attack chain for credential theft via Outlook and SMB, and provides all necessary scripts and setup instructions for replication.

This repository provides a proof-of-concept exploit for CVE-2024-21413, a critical remote code execution vulnerability in Microsoft Outlook (MonikerLink bug). The main script, CVE-2024-21413.py, is a Python3 command-line tool that automates the process of sending crafted HTML emails to target recipients. The script reads SMTP credentials and configuration from config.ini and uses a customizable HTML template (template/Stripo.html) to generate the email body. Users can set the subject, link (malicious URL), and recipient list via an interactive shell interface. The exploit leverages the vulnerability by embedding a malicious hyperlink in the email, which, when processed by a vulnerable Outlook client, can lead to code execution or other malicious outcomes. The repository includes documentation (README.md) with setup and usage instructions, a Makefile for convenience, and a security disclaimer. The exploit is operational as a POC and requires the attacker to control a valid SMTP account and know the target's email address. No hardcoded malicious URLs are present; the payload link is user-supplied, making the exploit flexible for different attack scenarios.

This repository is a Proof-of-Concept (PoC) exploit for CVE-2024-21413, a Microsoft Outlook Remote Code Execution vulnerability. The main exploit script (CVE-2024-21413.py) is a Python program that automates the process of sending a phishing email to a target using customizable HTML templates. The email contains a file:// URL pointing to an attacker-controlled SMB share. When the victim opens the email in Outlook, Outlook attempts to access the SMB share, causing the victim's system to send NTLM authentication data to the attacker's server. The script also integrates with impacket-smbserver to capture these NTLM hashes for further exploitation. The repository includes two HTML email templates designed to mimic Microsoft security notifications. The exploit requires the attacker to provide SMTP server credentials and run the script as root. The overall structure is straightforward: one main Python exploit script, a README, a license, and two HTML templates for phishing emails. The exploit is a PoC and does not include weaponized payloads beyond NTLM hash capture, but it demonstrates the attack chain and can be used for further escalation if combined with other vulnerabilities.

This repository contains a proof-of-concept (POC) exploit for CVE-2024-21413, a vulnerability in Microsoft Outlook that allows attackers to leak NTLM hashes via a crafted email. The main file, CVE-2024-21413.py, is a Python script that automates sending a specially crafted email to a target recipient using SMTP. The email contains an HTML link to a file:// URL pointing to an attacker-controlled SMB share. When the recipient opens the email and clicks the link in Outlook, their client attempts to access the SMB share, causing their NTLM credentials to be sent to the attacker. The README provides detailed usage instructions, including setting up an SMB listener with impacket-smbserver and running the exploit script. The repository is structured simply, with one exploit script and a README. No hardcoded endpoints are present; the attacker supplies all relevant parameters at runtime. The exploit is a POC and does not include weaponized or automated post-exploitation features.

This repository contains a proof-of-concept exploit for CVE-2024-21413, a critical remote code execution vulnerability in Microsoft Outlook. The main file, 'outlook-exploit.py', is a Python script that sends a crafted HTML email via Outlook's SMTP server. The email contains a malicious file:// link pointing to a remote SMB share (192.168.233.40), which, when opened by a vulnerable Outlook client, can trigger NTLM credential disclosure and potentially remote code execution. The script requires the attacker to provide valid Outlook credentials and the recipient's email address. The repository is structured simply, with a license, a README describing the vulnerability and usage, and the exploit script itself. No detection or fake code is present; this is a functional PoC demonstrating the attack vector.

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-21413, a critical remote code execution vulnerability in Microsoft Outlook (the MonikerLink bug). The main file, CVE-2024-21413.py, is a Python script that sends a specially crafted email via an authenticated SMTP server. The email contains both plain text and HTML parts, with the HTML part embedding a base64-encoded image and a malicious file:// link. When the recipient opens the email in Outlook, the crafted link can trigger NTLM credential leakage (0-click) or, if clicked, remote code execution (1-click), bypassing Office Protected View. The script requires SMTP credentials and various parameters (server, port, username, password, sender, recipient, malicious URL, and subject). The README provides detailed usage instructions, background on the vulnerability, and demonstration images. The exploit is a PoC and does not include a weaponized payload, but it effectively demonstrates the attack vector and impact of the vulnerability.

This repository provides a proof-of-concept exploit for CVE-2024-21413, a vulnerability in Microsoft Outlook that allows for credential leakage via specially crafted emails containing file:// links. The repository contains two files: a README.md with detailed usage instructions and background, and cve-2024-21413.sh, an Expect script that automates sending a malicious email via SMTP. The script crafts an email with an HTML body containing a link to a file:// URL pointing to an attacker-controlled SMB share. When a vulnerable Outlook client previews or clicks the link, it attempts to access the SMB share, causing the user's NTLM credentials to be sent to the attacker's SMB listener. The README also describes how to capture and crack the hashes. No hardcoded endpoints are present; the attacker specifies the SMB path as a script argument. The exploit is a POC and does not include weaponized payloads or automation for post-exploitation.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-21413, a vulnerability in Microsoft Outlook that allows remote code execution or credential theft via malicious 'file://' links in emails. The main exploit is implemented in 'exploit.py', a Python script that sends a crafted HTML email from 'attacker@monikerlink.thm' to 'victim@monikerlink.thm' via SMTP. The email contains a 'file://' link pointing to an attacker-controlled SMB share. When the victim opens the email in a vulnerable Outlook client, Outlook attempts to access the remote file, causing the victim's system to initiate an SMB authentication attempt to the attacker's server, potentially leaking NTLM credentials. The repository is structured for educational/lab use, with instructions for setting up the environment and capturing credentials using tools like Responder or impacket-smbserver. No advanced payload or post-exploitation is included; the exploit is a basic PoC demonstrating the vulnerability's impact.