ID:10644 - Exploit for Not Failing Securely ('Failing Open') in Windows and Windows Server - CVE-2024-43532

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to escalate privileges in Active Directory domain.

The vulnerability exists due to the way the Remote Registry client handles RPC authentication during certain fallback scenarios when SMB transport is unavailable. A remote user can authenticated against the AD server, intercept the NTLM authentication handshake from the client and forward it to another service, such as the (ADCS), and create a new domain administrator.

Successful exploitation of the vulnerability may allows a domain user to take over the entire AD.

Remediation