The exploit allows an attacker to escalate privileges on Microsoft Windows 11 systems by leveraging a vulnerability in the kernel. By manipulating IOCTL buffers and exploiting the SystemHandleInformation method, an attacker can gain elevated privileges on the target system. This vulnerability has been assigned CVE-2024-21338.
The Microsoft Windows XRM-MS file type, associated with software licensing, allows adversaries to inject XML stylesheets pointing to LAN network shares or attacker-controlled infrastructure. This leads to outbound connections leaking the target's NTLM hash. The exploit works through LAN network shares or remote drive-by downloads, requiring user interaction to open the file. The xrm-ms file type bypasses some security measures and appears trust-worthy as it defaults to opening in Internet Explorer or Edge on Windows systems.
Services By CQR