ABUSING MICROSOFT ACCESS “LINKED TABLE” FEATURE TO PERFORM NTLM FORCED AUTHENTICATION ATTACKS

Summary from the TLDR InfoSec newsletter

This post goes through how Microsoft Access can be used to perform a remote attack. It is done by using the "linking to remote SQL Server tables" feature, enabling attackers to leak the Windows user’s NTLM tokens to any attacker-controlled server. The attack can be launched as long as the victim opens an .accdb or .mdb file.