CVE-2025-24054 — Detection & Mitigation Lab

Project log for a defensive security lab on CVE-2025-24054, the Windows New Technology LAN Manager (NTLM) Hash Disclosure Spoofing vulnerability, under the assumption that the affected system cannot be patched short-term.

Blue-team educational project (Murdoch University ICT279). The exploitation technique is publicly documented (Check Point, CISA KEV); the original contribution is the detection + mitigation methodology. No live credentials or the VM credential sheet are stored in this repository.

The vulnerability

Windows auto-parses .library-ms files (Extensible Markup Language (XML) library descriptors). A malicious file embeds a Universal Naming Convention (UNC) path to an attacker server; on merely viewing or extracting it, Windows opens an outbound Server Message Block (SMB) connection on Transmission Control Protocol (TCP) port 445 and transmits the user's Net-NTLMv2 hash — no click required.

Lab architecture

   Isolated lab network (<SUBNET>/24, air-gapped)
   ┌────────────────┐   ┌────────────────┐   ┌────────────────┐
   │ Attacker (Kali)│   │ Victim (Win10) │   │ SIEM (Ubuntu)  │
   │ Responder      │◄──┤ Sysmon + Agent ├──►│ Wazuh Manager  │
   └────────────────┘SMB└────────────────┘   └────────────────┘
                     445

Detection pipeline: Sysmon → Windows Event Log → Wazuh Agent → Wazuh Manager → Custom Rules → Dashboard Alert

Contents

• detection/ — Sysmon config + custom Wazuh rules
• mitigation/ — Group Policy Object (GPO) NTLM restriction
• exploit/ — defensive description of the trigger (placeholder IPs)
• docs/ — walkthrough, limitations, and screenshot evidence log

Two findings from implementation (documented, not assumed)

1. The outbound port-445 connection is attributed to System (Process ID 4), the kernel SMB redirector — not explorer.exe. The detection rule therefore uses no image-name filter, which is what makes it fire.
2. The blocked-NTLM event on the victim is Event ID 4001 ("Blocking NTLM"), not 8002 as some documentation states. The lab environment is the authority.

References

• Check Point Research (2025). CVE-2025-24054, NTLM Exploit in the Wild.
• CISA (2025). Known Exploited Vulnerabilities Catalog: CVE-2025-24054.
• Microsoft Learn (2022). Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers.
• MITRE ATT&CK (2025). T1187: Forced Authentication.