# CVE-2024-21413 – Microsoft Outlook Moniker Link Vulnerability

![Platform](https://img.shields.io/badge/Platform-TryHackMe-red)
![Category](https://img.shields.io/badge/Category-Vulnerability%20Analysis-blue)
![Difficulty](https://img.shields.io/badge/Difficulty-Intermediate-orange)
![Focus](https://img.shields.io/badge/Focus-Credential%20Leak-green)
![Status](https://img.shields.io/badge/Status-Completed-success)

---

# Overview

This repository documents my hands-on analysis of **CVE-2024-21413 (Moniker Link)**, a critical Microsoft Outlook vulnerability that bypasses Protected View to leak Windows NetNTLMv2 credentials via SMB authentication.

> **Severity:** Critical (CVSS 9.8)

---

# Learning Objectives

- Understand Moniker Links
- Learn how Outlook Protected View works
- Analyze CVE-2024-21413
- Capture NTLM credentials
- Detect malicious emails
- Apply mitigation strategies

---

# Vulnerability Details

| Field | Value |
|-------|--------|
| CVE | CVE-2024-21413 |
| Published | 13 February 2024 |
| Vendor | Microsoft |
| Severity | Critical |
| CVSS | 9.8 |
| Impact | Credential Leak & Potential RCE |
| Attack Complexity | Low |

---

# Attack Flow

```
Attacker
    │
    ▼
Malicious HTML Email
    │
    ▼
Victim Clicks Moniker Link
    │
    ▼
Protected View Bypass
    │
    ▼
SMB Authentication
    │
    ▼
Responder
    │
    ▼
NetNTLMv2 Hash Captured
```

---

# Lab Environment

- TryHackMe AttackBox
- Vulnerable Windows Machine
- Microsoft Outlook
- Python PoC
- Responder
- Wireshark

---

# Exploitation Steps

1. Configure Python PoC
2. Modify attacker IP
3. Configure SMTP server
4. Start Responder
5. Send malicious email
6. Victim clicks Moniker Link
7. SMB authentication occurs
8. NetNTLMv2 hash captured

---

# Detection

## YARA

Detects:
- `file://`
- Suspicious HTML hyperlinks
- Moniker Link exploitation attempts

## Network Detection

- SMB authentication requests
- Unexpected outbound SMB traffic
- NetNTLMv2 authentication events

## Tools

- YARA
- Wireshark
- Responder

---

# Mitigation

- Install Microsoft February 2024 security updates
- Keep Office updated
- Educate users against phishing
- Verify hyperlinks before clicking
- Monitor SMB traffic
- Restrict outbound SMB where appropriate

---

# Skills Learned

- Vulnerability Analysis
- Outlook Security
- Email Security
- NTLM Authentication
- Credential Theft
- SMB Protocol
- Responder
- YARA Detection
- Wireshark Analysis
- Incident Detection

---

# Key Takeaways

- Outlook Protected View can be bypassed.
- Moniker Links abuse Windows COM functionality.
- SMB authentication leaks NetNTLMv2 hashes.
- Patch management is the most effective defense.
- Detection requires both endpoint and network monitoring.

---

# References

- Microsoft Security Advisory
- Check Point Research
- TryHackMe – Moniker Link (CVE-2024-21413)

---

⭐ If you found this repository useful, feel free to star it and connect with me on LinkedIn as I continue documenting my cybersecurity learning journey.