cyber security news

Leaked Wallpaper Exploit Let Attackers Escalate Privilege on Windows Systems Guru Baran

A critical security flaw in Windows’ wallpaper handling mechanism has been uncovered. It allows attackers to gain system-level privileges on affected machines. Security researcher Andrea Pierini disclosed the vulnerability, which is tracked as CVE-2024-38100 and dubbed “FakePotato.”

The FakePotato exploit takes advantage of a flaw in how Windows processes wallpaper files. By manipulating certain properties of a specially crafted wallpaper image, an attacker with limited access to a system can elevate their privileges to those of the SYSTEM account, effectively gaining complete control over the machine.

• Requires local access or the ability to place a malicious wallpaper file on the target system
• Affects multiple versions of Windows, including Windows 10 and Windows Server 2019
• Exploits the wallpaper handling process to gain SYSTEM privileges

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide

The Windows File Explorer Elevation of Privilege Vulnerability (CVE-2024-38100) was assigned a CVSS v3.x base score of 7.8, indicating a high severity level. This security flaw affected multiple versions of Windows Server, including:

• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2022 23H2

Leaked Wallpaper Exploit Details

The proof-of-concept (PoC) exploit, developed by a GitHub user known as Michael Zhmaylo, demonstrated how attackers could leverage this vulnerability to gain unauthorized access to user credentials. The exploit worked as follows:

1. An attacker with a low-privileged account on the target system would run the exploit tool.
2. The tool would target a specific user session, typically one with higher privileges.
3. By manipulating the Windows File Explorer, the exploit could force the target session to attempt connecting to a malicious SMB share.
4. This connection attempt would leak the NetNTLM hash of the targeted user.

The successful exploitation of this vulnerability could allow attackers to:

• Escalate privileges on affected systems
• Gain unauthorized access to sensitive user information
• Potentially move laterally within a network using the obtained credentials

Security experts warn that this type of exploit could be particularly dangerous in enterprise environments where lateral movement and privilege escalation are key components of advanced persistent threats (APTs).

Microsoft addressed this vulnerability in the security update KB5040434. Users and system administrators are strongly advised to apply this patch as soon as possible to mitigate the risk of exploitation. Additionally, organizations should consider implementing the following security measures:

• Regularly update all Windows systems and applications
• Implement the principle of least privilege for user accounts
• Monitor for suspicious activities related to privilege escalation attempts
• Use strong authentication methods and consider multi-factor authentication where possible

While Microsoft has patched this particular vulnerability, it underscores the importance of maintaining up-to-date systems and employing robust security practices to protect against emerging threats.

As cyber threats evolve, staying informed about the latest vulnerabilities and promptly applying security updates remains crucial for maintaining the integrity and security of Windows-based systems and networks.

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

The post Leaked Wallpaper Exploit Let Attackers Escalate Privilege on Windows Systems appeared first on Cyber Security News.