Unisys WebPerfect Image Suite NTLMv2 Hash Leakage Vulnerability via .NET Remoting

A vulnerability in Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes. This is achieved by exploiting a deprecated .NET Remoting TCP channel, where attackers can supply a Windows UNC path as a target file argument. The object-unmarshalling techniques used in this process enable the interception of NTLMv2 hashes, which can then be relayed to other hosts for privilege escalation or lateral movement, depending on the network configuration and patch level.

Impact

Successful exploitation of this vulnerability leads to the unauthorized leakage of NTLMv2 machine-account hashes, which can be captured and relayed to other hosts to achieve privilege escalation or lateral movement, based on the network environment and applied patches.