CVE-2025-24071

This exploit generates a malicious .library-ms file that, when opened, forces Windows to connect to an attacker-controlled SMB share. It leverages CVE-2025-24071, a vulnerability in Windows Library files, to achieve remote code execution via SMB relay attacks.

This exploit generates a malicious .library-ms file pointing to an attacker-controlled SMB server, packages it into a ZIP archive, and leverages Windows File Explorer's automatic SMB authentication to leak NTLM hashes. No user interaction is required beyond extracting the ZIP.

This PoC demonstrates CVE-2025-24071, an NTLM hash leak vulnerability triggered by extracting a .library-ms file from a ZIP archive. The exploit generates a malicious .library-ms file that forces Windows Explorer to initiate an SMB authentication request to an attacker-controlled IP.

This repository contains a PoC exploit for CVE-2025-24071, a Windows File Explorer spoofing vulnerability. The exploit generates a malicious `.library-ms` file that triggers an SMB authentication request, potentially exposing the user's NTLM hash.

This Metasploit module exploits CVE-2025-24071 by generating a malicious .library-ms file embedded in a ZIP archive. When extracted, it triggers an SMB authentication request to an attacker-controlled server, leaking NTLM hashes.

This PoC exploits a vulnerability in Windows Explorer (CVE-2025-24071/CVE-2025-24054) by crafting a malicious `.library-ms` file embedded in a ZIP archive. When extracted, it triggers an SMB connection to an attacker-controlled IP, leaking NetNTLMv2 hashes.

This repository contains a functional PoC for CVE-2025-24071, which exploits an NTLM hash leak via .library-ms files on unpatched Windows systems. The exploit generates a malicious .library-ms file that triggers an SMB authentication request when previewed in Windows Explorer, leaking the NTLMv2 hash to an attacker-controlled server.

This repository contains a proof-of-concept exploit for CVE-2025-24071, a Windows File Explorer spoofing vulnerability. The exploit generates a malicious `.library-ms` file that triggers an SMB authentication request, potentially exposing the user's NTLM hash.

This PoC generates a malicious .library-ms file that references a remote SMB share, exploiting CVE-2025-24071 to trigger arbitrary file access or code execution when the file is opened. The script creates a ZIP archive containing the exploit file for delivery.

The repository contains functional exploit code for multiple CVEs, including authentication bypass vulnerabilities in TOTOLINK devices and a scanner for Fortinet SSL VPN (CVE-2024-21762). The PoCs demonstrate the vulnerabilities with clear technical details and functional code.

This PoC exploits CVE-2025-24071 by generating a malicious '.library-ms' file embedded in a ZIP archive. When extracted by a Windows victim, it triggers an NTLM authentication request to an attacker-controlled SMB server via UNC path injection, leaking NTLMv2 hashes.

This PoC generates a malicious '.searchconnector-ms' file that triggers automatic SMB authentication to a specified IP when opened or stored on a Windows system, exploiting CVE-2025-24071. The script creates an XML-based file that forces the target system to attempt authentication with the attacker-controlled SMB share.

This PoC exploits CVE-2025-24071 by generating a malicious .library-ms file embedded in a .tar archive, which triggers NTLM hash leakage when extracted on a vulnerable Windows system via SMB. The attack leverages Responder to capture authentication attempts.

This PoC demonstrates CVE-2025-24071, a Windows File Explorer spoofing vulnerability that exposes NTLM hashes via malicious `.library-ms` files embedded in archives. The exploit generates a crafted `.library-ms` file pointing to an attacker-controlled SMB share, packages it into a ZIP, and triggers automatic SMB authentication upon extraction.

This PoC exploits CVE-2025-24071 by generating a malicious .library-ms file embedded in a ZIP archive. When extracted on a vulnerable Windows system, it triggers an automatic SMB authentication request to an attacker-controlled server, leaking NTLM hashes.

The repository contains a functional exploit for CVE-2025-24071, a Windows File Explorer spoofing vulnerability that leverages malicious `.library-ms` files in RAR/ZIP archives to trigger SMB authentication requests, potentially exposing NTLM hashes. The provided Python script automates the creation of such archives for exploitation.

This repository contains a PoC for CVE-2025-24071, a Windows File Explorer spoofing vulnerability that exploits implicit trust in `.library-ms` files to trigger SMB authentication requests, potentially exposing NTLM hashes. The PoC includes a Python script to generate malicious ZIP/RAR files for exploitation.

This PoC demonstrates CVE-2025-24071, a vulnerability in Windows Explorer where extracting a ZIP containing a malicious `.library-ms` file triggers an automatic SMB connection to an attacker-controlled server, leaking netNTLMv2 credentials.

The repository contains a functional exploit PoC for CVE-2025-24071, demonstrated by a Windows executable that interacts with a target system via SMB. The README provides clear instructions for execution, including setting up an SMB server for payload delivery.

The repository contains a functional exploit for CVE-2025-24071, a Windows File Explorer spoofing vulnerability. The exploit generates a malicious `.library-ms` file that triggers an SMB authentication request, potentially exposing the user's NTLM hash when decompressed.

This PoC exploits CVE-2025-24071, a vulnerability in Windows File Explorer that leaks NTLM hashes when a user extracts a crafted ZIP archive containing a malicious `.library-ms` file. The exploit generates a ZIP file that triggers an SMB authentication request to an attacker-controlled server upon extraction.

The repository contains only a README file with minimal information, mentioning CVE-2025-24054 and CVE-2025-24071 but no functional exploit code or technical details. It appears to be a placeholder without substantive content.

This PoC exploits CVE-2025-24071, a Windows File Explorer spoofing vulnerability, by generating a malicious `.library-ms` file that triggers NTLM hash leakage to an attacker-controlled SMB share. The script automates the creation of the malicious file, packages it in a ZIP, and uploads it to a target SMB share.

This PoC demonstrates an NTLM hash leak vulnerability in Windows Explorer by creating a malicious .library-ms file embedded in a ZIP archive. When extracted, the file triggers an SMB authentication request to an attacker-controlled IP, leaking NTLM hashes without user interaction.

This PoC exploits CVE-2025-24071, a Windows File Explorer spoofing vulnerability, by crafting a malicious .library-ms file embedded in a ZIP archive. When extracted, it triggers an SMB connection to leak NTLM hashes via a controlled SMB server.

This Metasploit module exploits CVE-2025-24071 by generating a malicious .library-ms file embedded in a ZIP archive. When extracted, it triggers an SMB request to an attacker-controlled server, leaking NTLM hashes.

This Rust-based PoC demonstrates CVE-2025-24071 by generating a malicious .library-ms file that points to a network share, which can trigger NTLM authentication leaks when opened. The exploit leverages GitHub Actions for automated deployment.

This PoC generates a malicious .library-ms file embedded in a ZIP archive to exploit CVE-2025-24071, which leaks NTLM hashes via SMB when the victim extracts and opens the file. The exploit requires an attacker-controlled SMB share to capture the hash.

This PoC generates a malicious .library-ms file that exploits CVE-2025-24071 by embedding a UNC path to an attacker-controlled SMB share, likely triggering arbitrary code execution via Windows Library file handling. The script creates a ZIP archive containing the exploit file for delivery.