michaelis labs

offensive security, real-world impact

CVE 2025-24071

—

by

michaelis
in ,

Server-side ZIP extraction leads to NTLM hash leakage.

This specific vulnerability exploits NTLM Hash Leak via RAR/ZIP extraction and .library-ms file. The proof-of-concept: GitHub – 0x6rss/CVE-2025-24071_PoC: CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File · GitHub

Steps

  1. Start Responder (responder -I tun0 -v)
  2. python3 poc.py (Enter your tun0 IP when prompted)
  3. A .zip file is created which when uploaded to target trigger a callback to your responder
  4. Save the hash and crack it