Exploit / PoCcritical
Comprehensive analysis of initial attack samples exploiting CVE-2023
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) | 9.8 | 97% | KEV | KEV |
| CVE-2023-29324 | Windows MSHTML Platform Security Feature Bypass Vulnerability | 6.5 | 3% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 101.255.119.42 | detection/verification). URLs (#16) \\5.199.162[.]132\SCW \\101.255.119[.]42\event\2431 \\101.255.119[.]42\mail\a5b3553d \\181.209.99[ |
| ipv4 | 113.160.234.229 | ]21\pets \\185.132.17[.]160\aojv43 \\69.51.2[].106\report \\113.160.234[.]229\istanbul \\85.195.206[.]7\lrmng \\24.142.165[.]2\req \\85 |
| ipv4 | 168.205.200.55 | \\181.209.99[.]204\information \\213.32.252[.]221\silence \\168.205.200[.]55\test \\213.32.252[.]221\fwd \\69.162.253[.]21\pets \\185. |
| ipv4 | 181.209.99.204 | .255.119[.]42\event\2431 \\101.255.119[.]42\mail\a5b3553d \\181.209.99[.]204\information \\213.32.252[.]221\silence \\168.205.200[.]55 |
| ipv4 | 185.132.17.160 | 0[.]55\test \\213.32.252[.]221\fwd \\69.162.253[.]21\pets \\185.132.17[.]160\aojv43 \\69.51.2[].106\report \\113.160.234[.]229\istanbu |
| ipv4 | 213.32.252.221 | 255.119[.]42\mail\a5b3553d \\181.209.99[.]204\information \\213.32.252[.]221\silence \\168.205.200[.]55\test \\213.32.252[.]221\fwd \\ |
| ipv4 | 24.142.165.2 | eport \\113.160.234[.]229\istanbul \\85.195.206[.]7\lrmng \\24.142.165[.]2\req \\85.195.206[.]7\power \\61.14.68[.]33\rem \\42.98.5[ |
| ipv4 | 42.98.5.225 | 42.165[.]2\req \\85.195.206[.]7\power \\61.14.68[.]33\rem \\42.98.5[.]225\ping IPs (#14) 5.199.162[.]132 (not in MS Guidance public |
| ipv4 | 5.199.162.132 | nd useless for threat detection/verification). URLs (#16) \\5.199.162[.]132\SCW \\101.255.119[.]42\event\2431 \\101.255.119[.]42\mail |
| ipv4 | 61.14.68.33 | 206[.]7\lrmng \\24.142.165[.]2\req \\85.195.206[.]7\power \\61.14.68[.]33\rem \\42.98.5[.]225\ping IPs (#14) 5.199.162[.]132 (not i |
| ipv4 | 69.162.253.21 | 21\silence \\168.205.200[.]55\test \\213.32.252[.]221\fwd \\69.162.253[.]21\pets \\185.132.17[.]160\aojv43 \\69.51.2[].106\report \\1 |
| ipv4 | 69.51.2.106 | 252[.]221 168.205.200[.]55 69.162.253[.]21 185.132.17[.]160 69.51.2[.]106 (not in MS Guidance publication) 113.160.234[.]229 85.195 |
| ipv4 | 77.238.121.148 | 06.7\power (reminder time set to 2022-01-31 23:30) Sent by: 77.238.121.148 on 2023-03-17 14:04:54 UTC Target: IT integrator – UA Remin |
| ipv4 | 82.196.113.102 | 1.14.68[.]33 42.98.5[.]225 (not in MS Guidance publication) 82.196.113[.]102 (only in MS Guidance publication – on VT relating to hash |
| ipv4 | 85.195.206.7 | ojv43 \\69.51.2[].106\report \\113.160.234[.]229\istanbul \\85.195.206[.]7\lrmng \\24.142.165[.]2\req \\85.195.206[.]7\power \\61.14 |
| sha256 | 92df1d2125f88d0642e0d4919644376c09e1f1e0eaf48c31a6b389265e0d5576 | 2 (only in MS Guidance publication – on VT relating to hash 92df1d2125f88d0642e0d4919644376c09e1f1e0eaf48c31a6b389265e0d5576, but missing the sample and any additional information) Thr |
From the original article
11 min read at securelist.com
On March 14, 2023, Microsoft published a blogpost describing an Outlook Client Elevation of Privilege Vulnerability (CVSS: 9. 8 CRITICAL). The publication generated a lot of activity among white, grey and black hat researchers, as well as lots of publications and tweets about the vulnerability and its exploitation.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.