CVE-2025-24071 PoC — Microsoft Windows File Explorer Spoofing Vulnerability

Source

https://github.com/0x6rss/CVE-2025-24071_PoC

Associated Vulnerability

Title: Microsoft Windows File Explorer Spoofing Vulnerability (CVE-2025-24071)
Description:Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

Description

CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File

Readme

# CVE-2025-24071_PoC
CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File

### Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute the file—simply extracting it is enough to trigger the leak.

#### blog post: 
[https://cti.monster/blog/2025/03/18/CVE-2025-24071.html](https://cti.monster/blog/2025/03/18/CVE-2025-24071.html)

## usage 

```bash

>>python poc.py

>>enter file name: your file name

>>enter IP: attacker IP
```

### video


https://github.com/user-attachments/assets/fa6f16da-70ce-45e5-ac55-0c92a3623cad

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →