topic Re: LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112 in Cortex XDR Discussions

LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112

RPathivada — Thu, 02 Jan 2025 12:37:22 GMT

Hi ,

How to check for the below actions in xql builder.

please help in developing a query

The attacker sends a DCE/RPC request to the Victim Server Machine
The Victim is triggered to send a DNS SRV query about SafeBreachLabs.pro
The Attacker’s DNS server responds with the Attacker’s hostname machine and LDAP port
The Victim sends a broadcast NBNS request to find the IP address of the received hostname (of the Attacker’s)
The Attacker sends an NBNS response with its IP Address
The Victim becomes an LDAP client and sends a CLDAP request to the Attacker’s machine
The Attacker sends a CLDAP referral response packet with a specific value resulting in LSASS to crash and force a reboot of the Victim server

Re: LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112

tlmarques — Wed, 08 Jan 2025 15:40:09 GMT

I've open a administrative case for get informations about XDR and if XDR prevent the attack and how we can search on XQL.

Re: LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112

tlmarques — Wed, 08 Jan 2025 18:36:08 GMT

@RPathivada , official response is:

"...there is currently no Proof of Concept (PoC) available for this CVE, which means coverage is not possible at this time. However, it has been added to our monitoring list, and coverage will be implemented as soon as a valid PoC is identified."

For more details, you can refer to this article:
[Knowledge Base Article](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAOnCAO)