Windows MSHTML zero-day exploits shared on hacking forums

Reading Time: 2 Minutes

Last Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim’s computer remotely.

Even though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.

These mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.

However, researchers have been able to modify the exploit not to use ActiveX, effectively bypassing Microsoft’s mitigations.

Guides and PoCs shared on hacking forums

When Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.

While they soon reproduced the exploits, modified them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.

Unfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.

Starting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.

See Also: Complete Offensive Security and Ethical Hacking Course

On Saturday, as researchers began releasing more details on Github and Twitter, the threat actors shared further details on how to generate all aspects of the exploit.

The information is simple to follow and allows anyone to create their own working version of the CVE-2021-40444 exploit, including a python server to distribute the malicious documents and CAB files.

Using this information, BleepingComputer could reproduce the exploit in about 15 minutes, as demonstrated in the video below.

Defending against the CVE-2021-40444 MSHTML vulnerability 

The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.

For example, you can see below Microsoft Defender blocking the exploit as ‘Trojan:Win32/CplLoader.a’ and ‘TrojanDownloader:HTML/Donoff.SA’ detections.

See Also: Windows MSHTML zero-day defenses bypassed as new info emerges

See Also: Offensive Security Tool: Jenkins Attack Framework

Disable document preview in Windows Explorer

Security researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.

Since this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:

1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key:

   For Word documents, navigate to these keys:

   • HKEY_CLASSES_ROOT.docx\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
   • HKEY_CLASSES_ROOT.doc\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
   • HKEY_CLASSES_ROOT.docm\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}

   For rich text files (RTF), navigate to this key:

   • HKEY_CLASSES_ROOT.rtf\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
2. Export a copy of the Registry key as a backup.
3. Now double-click Name and in the Edit String dialog box, delete the Value Data.
4. Click OK,

See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker

Word document and RTF file previews are now disabled in Windows Explorer.

To enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.

While these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.

Until Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.

Source: www.bleepingcomputer.com

(Click Link)