Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-24054-PoC — Proof-of-concept exploit for CVE-2025-24054, a Windows Library (.library-ms) NTLM hash disclosure vulnerability. Generates a malicious .library-ms file to leak Net-NTLMv2 hashes via SMB when extracted from a ZIP archive. | Kitploit
Tools/GitHubGitHub/simantchaudhari/cve-2025-24054-poc
Password CrackingVulnerability AnalysisExploitationInformation GatheringLearning & EducationLabs & Practice
GitHubsimantchaudhari/cve-2025-24054-poc

CVE-2025-24054-PoC

Proof-of-concept exploit for CVE-2025-24054, a Windows Library (.library-ms) NTLM hash disclosure vulnerability. Generates a malicious .library-ms file to leak Net-NTLMv2 hashes via SMB when extracted from a ZIP archive.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository
34 months agoNot yet reviewed

CVE-2025-24054 PoC

A simple Proof of Concept for CVE-2025-24054 – Windows Library (.library-ms) NTLM Hash Disclosure Vulnerability.

⚠️ For Educational and Authorized Lab Use Only

Description

CVE-2025-24054 allows an attacker to force a Windows system to leak the victim's Net-NTLMv2 hash by using a specially crafted .library-ms file.

When the victim extracts a ZIP containing the malicious .library-ms file, Windows Explorer automatically initiates an SMB connection, leaking the NTLM hash.

How It Works

  1. Attacker generates a malicious .library-ms file containing a UNC path pointing to their machine.
  2. The file is delivered inside a ZIP archive.
  3. Victim extracts the ZIP file.
  4. Windows Explorer automatically attempts to load the library, triggering an NTLM authentication request.
  5. Attacker captures the Net-NTLMv2 hash using Responder.

alt text

1. Usage

python poc.py -i YOUR-IP

2. Start Responder (Attacker Machine)

sudo responder -I eth0

Download Tool