CVE-2025-50154

Classification basis

The script's stated purpose is to 'Create a malicious LNK file that triggers SMB NTLMv2-SSP hash disclosure' (line 19). It generates a file that, when interacted with, causes the victim's machine to send authentication credentials to an attacker-controlled server. This is active exploitation code, not merely a detection or reporting tool.

Requirements

• An attacker-controlled SMB server (e.g., running Responder) must be listening on the network.exploits/windows/remote/52415.txt:14-15
• The victim must view the folder containing the generated .LNK file in Windows File Explorer.exploits/windows/remote/52415.txt:25-27

Observed behavior

• Creates a .LNK shortcut file with a target path pointing to a remote SMB share (\\<ip>\<share>\<file>).exploits/windows/remote/52415.txt:53-54exploits/windows/remote/52415.txt:60
• Sets the shortcut's icon to a local, default Windows icon (SHELL32.dll) to appear benign.exploits/windows/remote/52415.txt:55exploits/windows/remote/52415.txt:61
• When the shortcut is rendered by File Explorer, the system attempts to authenticate to the remote SMB server to fetch the icon, leaking the NTLMv2 hash.exploits/windows/remote/52415.txt:25-27

Observables

Network Target

Payload withheldThe script constructs a UNC path from user-supplied parameters and sets it as the shortcut target, which will cause Windows Explorer to attempt SMB authentication to the specified remote server.exploits/windows/remote/52415.txt:54

File Creation

Payload withheldThe script creates a .LNK file in the user-specified path, which is the delivery mechanism for the NTLMv2 hash disclosure attack.exploits/windows/remote/52415.txt:53

Classification basis

The artifact's primary purpose is to detect and audit for the vulnerability, not to exploit it. The README describes a toolkit for auditing, hardening, and hunting, and the Sigma rules are detection signatures. No code is present that exercises the vulnerability to gain unauthorized access or leak credentials.

Requirements

• The PowerShell script requires execution on a Windows host with appropriate permissions to read and modify registry, service, and firewall configurations.README.md:28-30
• The Sigma rules require a SIEM or log analysis platform with ingested Windows Event Logs (Security, Sysmon) or Windows Filtering Platform events.sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:13-16

Observed behavior

• The PowerShell script audits current registry, service, and firewall configurations and outputs pass/fail results with recommended fixes.README.md:27-28
• The PowerShell script applies security hardening settings such as NTLM restrictions, SMB signing, and disabling SMBv1.README.md:29-30
• The PowerShell script performs event hunting by gathering NTLM operational logs, security logon events, and Sysmon network connection events.README.md:33-38
• The Sigma rules detect Explorer.exe initiating SMB connections to untrusted networks, LNK file creation on desktops, and NTLM network logons to untrusted addresses.sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:1-4sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:60-63sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:90-93

Observables

File

Payload withheldDescribes a defensive toolkit for auditing and hardening NTLM/SMB configurations, with no executable payload.README.md:1-135

File

Payload withheldContains Sigma detection rules for identifying suspicious NTLM/SMB activity, with no executable payload.sigma_cve-2025-50154_ntlm_smb_hunting_f86eb3dc.yml:1-251

Classification basis

The artifact includes a functional PowerShell script (poc.ps1) that generates a malicious .LNK file designed to trigger an NTLMv2 hash disclosure vulnerability in Windows File Explorer. The README explicitly describes this as a 'Zero Click NTLMv2-SSP Hash Disclosure' and provides step-by-step instructions for setting up an attacker SMB server and deploying the crafted shortcut to a victim. This constitutes code intended to exercise a vulnerability, which meets the definition of an exploit.

Requirements

• An attacker-controlled SMB server (e.g., impacket-smbserver) hosting a PE binary file.README.md:35-36
• Ability to deliver the crafted .LNK file to the victim's filesystem (e.g., via malicious download or SMB upload).README.md:39

Observed behavior

• Creates a .LNK shortcut file with a target path pointing to a remote SMB-hosted binary and an icon location set to a local shell32.dll.poc.ps1:34-43
• When the .LNK file is rendered by explorer.exe, the process fetches the remote PE file to extract its icon resources, causing the victim to authenticate to the attacker's SMB server and disclose NTLMv2-SSP hashes.README.md:25README.md:46

Observables

Network Target

Payload withheldThe LNK file's TargetPath is set to a user-supplied remote SMB path, which is the core of the NTLM hash disclosure technique.poc.ps1:35poc.ps1:41

File Creation

Payload withheldThe script creates a .LNK file on the local filesystem at the user-specified path.poc.ps1:34poc.ps1:40-43

Classification basis

The artifact contains functional code (standalone_lnk_weaponizer.ps1) that creates malicious LNK files designed to trigger NTLM authentication to an attacker-controlled server, which is an active exploitation technique for credential theft. The README describes the Aggressor script as weaponizing LNK and Library-MS files for hash disclosure, and the PowerShell script includes the complete implementation to generate the weaponized file. This is exploit code, not merely a scanner or writeup.

Requirements

• An active Cobalt Strike beacon on the target system (for the Aggressor script) or local PowerShell execution (for the standalone script).README.md:18-19standalone_lnk_weaponizer.ps1:1-4
• An attacker-controlled SMB server (e.g., Responder, Impacket) running to capture the NTLM hashes.README.md:10-12
• User interaction: the target user must open or interact with the generated LNK or Library-MS file.README.md:111-112README.md:117-118

Observed behavior

• Generates a malicious LNK shortcut file that points to a remote SMB path (\\<attacker_ip>\<share>\<file>).standalone_lnk_weaponizer.ps1:112-125
• Creates a Library-MS XML file with a UNC path reference to trigger SMB authentication (payload withheld bypass technique).README.md:114-118
• Forces Windows Explorer to fetch the PE icon from the remote SMB location, triggering NTLM authentication and hash disclosure.README.md:108-112
• Provides Cobalt Strike right-click menu integration and command-line commands (lnk_create, library_create, lnk_quick, library_quick) for remote deployment via beacon.README.md:47-84

Observables

Offensive Tool

Payload withheldThe artifact is a tool for creating malicious LNK and Library-MS files to capture NTLMv2 hashes via SMB authentication, consistent with its stated purpose.README.md:1-3standalone_lnk_weaponizer.ps1:1-4

Cve Reference

Payload withheldThe README references payload withheld as a bypass technique for Library-MS files, but the supplied CVE context is for CVE-2025-50154 (Windows File Explorer spoofing). This mismatch is noted but does not indicate backdoor behavior.README.md:3