CVE-2024-43451
MEDIUM KEV RANSOMWARENTLM Hash Disclosure Spoofing - Info Disclosure
Title source: llmExploitation Summary
CVE-2024-43451 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 12, 2024, with confirmed use in ransomware campaigns. EIP tracks 2 public exploits from researchers including RonF98, razureink.
AI-analyzed exploit summary This repository provides a detailed technical writeup on CVE-2024-43451, a vulnerability in Microsoft Windows that allows attackers to capture NTLMv2 password hashes via SMB connections. It includes a step-by-step guide on setting up a POC environment using Responder and creating a malicious URL file to exploit the vulnerability.
Description
NTLM Hash Disclosure Spoofing Vulnerability
Exploits (2)
This repository provides a detailed technical writeup on CVE-2024-43451, a vulnerability in Microsoft Windows that allows attackers to capture NTLMv2 password hashes via SMB connections. It includes a step-by-step guide on setting up a POC environment using Responder and creating a malicious URL file to exploit the vulnerability.
This repository provides a functional proof-of-concept exploit for CVE-2024-43451, a Windows NTLMv2 hash disclosure vulnerability triggered via malicious .url shortcut files. The exploit crafts a .url file with a UNC path pointing to an attacker-controlled SMB server, forcing Windows Explorer to leak NTLM hashes upon minimal user interaction (e.g., right-click, delete, or move).
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N