Skip to content
Threat Feed
Subscribe

Tag

Ntlm

3 briefs RSS
medium advisory

Potential NetNTLMv1 Downgrade Attack via Registry Modification

This brief details a registry modification attack that downgrades the system to NTLMv1 authentication, enabling NetNTLMv1 downgrade attacks, typically performed with local administrator privileges on Windows systems.

Microsoft Defender XDR +2 defense-evasion ntlm registry-modification windows
2r 2t
high advisory

SiYuan Zero-Click NTLM Theft and Blind SSRF via Mermaid Diagrams

SiYuan is vulnerable to zero-click NTLM hash theft on Windows and blind SSRF on all platforms due to insecure Mermaid.js configuration, where a malicious Mermaid diagram containing a protocol-relative URL can be injected into a note, causing the Electron client to fetch the URL, triggering SMB authentication on Windows and sending the victim's NTLMv2 hash to the attacker. On macOS and Linux, the request acts as a tracking pixel and blind SSRF.

siyuan ntlm ssrf credential-theft mermaid
2r 3t 1c
medium advisory

Potential NetNTLMv1 Downgrade Attack via Registry Modification

Attackers modify the Windows registry to weaken NTLM authentication, forcing a downgrade to the less secure NTLMv1 protocol, potentially leading to credential compromise.

Windows ntlm downgrade registry defense-evasion credential-access
2r 2t