authenticity

A proof-of-concept exploit code for a vulnerability in Microsoft's Remote Registry client, identified as CVE-2024-43532, has been made publicly available. This vulnerability allows unauthorized control over a Windows domain by compromising the authentication process. It exploits a fallback mechanism in the Windows Registry client that defaults to older transport protocols when SMB transport is unavailable, enabling attackers to relay NTLM authentication to Active Directory Certificate Services (ADCS) and obtain user certificates for further domain authentication. The vulnerability arises from the management of RPC authentication during fallback situations, where weaker authentication levels are used. An attacker can create new domain administrator accounts by intercepting the NTLM authentication handshake and forwarding it to another service. The vulnerability was reported by Akamai researcher Stiv Kupchik to Microsoft, which initially dismissed it as a documentation issue before confirming it and releasing a fix. The researcher recently presented a working proof-of-concept at the No Hat security conference, detailing the exploitation process. Akamai's report includes methods for detecting the vulnerability and monitoring RPC calls related to the WinReg RPC interface.