Exploit Released for New Windows Server "WinReg" NTLM Relay Attack

A proof-of-concept exploit has been released for a vulnerability in Microsoft's Remote Registry client, identified as CVE-2024-43532. This flaw allows attackers to downgrade the security of the NTLM authentication process, potentially enabling them to take control of a Windows domain. The vulnerability affects all Windows Server versions from 2008 to 2022, as well as Windows 10 and 11. It exploits a fallback mechanism in the Remote Registry client that resorts to older, less secure transport protocols when SMB transport is unavailable. By relaying NTLM authentication to Active Directory Certificate Services (ADCS), an attacker could obtain user certificates and create new domain administrator accounts. The vulnerability was initially reported by Akamai researcher Stiv Kupchik in February 2024, but Microsoft dismissed it as a documentation issue. After further evidence was provided, Microsoft confirmed the vulnerability in July and released a fix three months later. The researcher has since shared a working PoC and detailed the exploitation process at a security conference. Recommendations for detection and monitoring of the vulnerability have also been provided.

- A new exploit for a Windows Server vulnerability (CVE-2024-43532) has been released.

- The flaw allows NTLM relay attacks, potentially leading to domain takeover.

- It affects Windows Server versions from 2008 to 2022 and Windows 10/11.

- The vulnerability was initially dismissed by Microsoft but later confirmed.

- Detection methods and monitoring recommendations have been shared by researchers.