Abusing Microsoft Access “Linked Table” Feature to Perform NTLM Forced Authentication Attacks

1. Microsoft Access (part of the Office suite) has a “linking to remote SQL Server tables” feature.


2. This feature can be abused by attackers to automatically leak the Windows user’s NTLM tokens to any attacker-controlled server, via any TCP port, such as port 80.


3. The attack can be launched as long as the victim opens an .accdb or .mdb file. In fact, any more-common Office file type (such as a .rtf ) can work as well


4. This technique …

abusing access attack attacker attackers attacks authentication feature leak malware analysis microsoft ntlm office port server sql sql server tables tcp tokens windows