search

CVE-2025-24071

hashtag
Proof of Concept for CVE-2025-24071: Windows File Explorer Spoofing Vulnerability

hashtag
Vulnerability

CVE-2025-24071

hashtag
Type

Windows File Explorer Spoofing via .library-ms files

hashtag
CVSS Score

7.8 (High)

hashtag
Description

CVE-2025-24071 is a spoofing vulnerability in Windows File Explorer that leverages the .library-ms file format. An attacker can craft this file to trick the user into connecting to a remote SMB server, potentially leaking NTLMv2 credentials.

hashtag
Environment Setup

  • Attacker (You): Kali Linux on VPN, IP: 10.10.14.228

  • Victim: HTB Machine "Fluffy"

  • Domain: fluffy.htb

  • Valid credentials: Username: j.fleischman, Password: J0elTHEM4n1990!

  • Writable SMB share discovered: IT

hashtag
Step 1: Enumerate SMB Shares

First, let's see what shared folders are available on the target and if we can write to any.

Expected output:

The IT share is what we’re interested in because it has both READ and WRITE permissions.

hashtag
Step 2: Build the Exploit File

Now we’ll use the public exploit script to generate a malicious .library-ms file wrapped in a ZIP.

This command tells the script:

  • -i: Your local IP address (Kali machine) or VPN (tun0)

  • -f: The name of the file we want to generate (e.g., Reports.library-ms)

After it runs, you’ll see a ZIP file called exploit.zip this is what we’ll upload to the target.

hashtag
Step 3: Upload the Exploit

We now push our exploit.zip file to the writable SMB share (IT) like this:

Then, within the smbclient prompt:

The share should now look like this:

hashtag
Step 4: Set Up Responder to Capture Hashes

Now, start Responder on your VPN interface to catch any incoming SMB authentication attempts:

Make sure the Responder window stays open it will capture NTLMv2 hashes automatically when the file is opened by the victim.

hashtag
Step 5: Wait for the Victim to Open the File

Once someone opens exploit.zip and interacts with Reports.library-ms, their system will silently try to connect to your Kali box. Responder will then capture their NTLMv2 hash.

You’ll see output like:

hashtag
What Can You Do With This Hash

  • You can crack it using hashcat or john to retrieve the plaintext password

  • Or, relay it in real-time to escalate privileges in certain scenarios (e.g., with ntlmrelayx)

hashtag
Resources

PreviousCVE 2025NextGandalf

Last updated