cesarbtakeda/windows-explorer-cve-2025-24071PoC exploit for CVE-2025-24071, a Windows File Explorer spoofing vulnerability that leaks NTLM hashes via malicious .library-ms files in RAR/ZIP archives. Includes detection and mitigation guidance.
NSFOCUS CERT has detected that Microsoft recently released a security update to address a critical spoofing vulnerability in Windows File Explorer, identified as CVE-2025-24071. This vulnerability has a CVSS score of 7.5, indicating its severity. The issue arises from the implicit trust and automatic file parsing behavior of .library-ms files in Windows Explorer. An unauthenticated attacker can exploit this vulnerability by constructing RAR/ZIP files containing a malicious SMB path. Upon decompression, this triggers an SMB authentication request, potentially exposing the user's NTLM hash. PoC (Proof of Concept) exploits for this vulnerability are now publicly available, making it a current threat. Affected users are strongly advised to apply the patch immediately to mitigate the risk.
Reference: Microsoft Security Update
To determine whether your system is at risk, follow these steps:
Check System Version:
winver, and press Enter. This will display the version and build number of your Windows operating system.Verify Patch Installation:
systeminfo to check the details of installed patches.Microsoft has released a security patch to address this vulnerability for all supported versions. It is crucial to apply the patch as soon as possible to protect against potential exploitation.
If the patch fails to install through Windows Update, you can manually download and install the standalone package by visiting the Microsoft Update Catalog.
For further information and updates, refer to the official Microsoft Security Response Center.
This tool is for educational purposes only. I am not responsible for any damage done by this tool. Please always stay within legal and ethical boundaries.
This project is licensed under the MIT License - see the LICENSE file for details.