CVE-2025-24054: Windows NTLM Hash Disclosure Vulnerability Analysis and POC

Vulnerability Overview CVE-2025-24054 is a vulnerability related to NTLM hash disclosure, exploited via deception. Attackers can exploit this vulnerability in the wild using a crafted file. The vulnerability has been observed in the wild since March 11, 2025, allowing attackers to obtain NTLM hashes, user passwords, and credentials. Although Microsoft released a patch on March 11, 2025, attackers continue to actively exploit this vulnerability. Impact Scope Targeted Organizations: Government and private institutions in Poland and Romania. Attack Method: Attackers use malware to distribute Dropbox links containing multiple exploits, including CVE-2025-24054 and NTLMv2-SSP hashes. Initial Reports: Initially, it was believed that the exploit occurred when the file was decompressed. However, Microsoft's patch documentation indicates that the vulnerability can be triggered with minimal user interaction, such as right-clicking, dragging and dropping, or performing any action. Mitigation Microsoft Patch: Microsoft released a patch on March 11, 2025, but attackers continue to actively exploit this vulnerability. Check Point Research: Reported multiple activities exploiting this vulnerability, including CVE-2025-24054 and CVE-2024-4351. POC Code 1. Example of File 2. Network Traffic Example ```plaintext SMB2:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x000000000000

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-24054: Windows NTLM Hash Disclosure Vulnerability Analysis and POC