ExploitPublished 1 May 2025

Microsoft - NTLM Hash Disclosure Spoofing (library-ms)

Source Exploit-DB RSS Feed

Mentioned vulnerabilities

CVE-2025-24054

Severity

Medium

Rated by Threat Radar

Data as of 11 Jun 2025, 21:11 UTC

What to do

AI-suggested

Immediate application of any available Microsoft patches or updates addressing CVE-2025-24054 is critical. Even if no direct patch exists yet, monitor Microsoft’s security update guide closely for releases.
Implement network segmentation to limit access to systems processing .library-ms files, reducing the attack surface for remote exploitation.
Enforce strict network access controls and monitor for unusual access patterns to Windows file shares and library folders.
Disable or restrict the use of NTLM authentication where possible, migrating to more secure protocols such as Kerberos.
Employ multi-factor authentication (MFA) to reduce the impact of credential theft.
Conduct regular credential hygiene practices, including frequent password changes and use of strong, unique passwords.
Deploy endpoint detection and response (EDR) solutions to identify suspicious activities related to .library-ms file handling or NTLM hash extraction attempts.
Educate IT and security teams about the specific nature of this exploit and the risks associated with NTLM hash disclosure.
Use network intrusion detection systems (NIDS) with signatures or heuristics tuned to detect exploitation attempts leveraging this vulnerability.
Restrict the execution of unauthorized scripts or binaries, including Perl scripts, on critical systems to hinder exploit deployment. These measures, combined with vigilant monitoring and incident response readiness, will help mitigate the risk posed by this vulnerability.

Description

Microsoft - NTLM Hash Disclosure Spoofing (library-ms)

Impact

For European organizations, this vulnerability presents a significant risk, especially for enterprises heavily reliant on Windows infrastructure and legacy authentication protocols like NTLM. Disclosure of NTLM hashes can lead to credential theft, enabling attackers to impersonate legitimate users, escalate privileges, and move laterally across networks. This can result in unauthorized access to sensitive data, disruption of services, and potential data breaches. Sectors such as finance, government, healthcare, and critical infrastructure in Europe are particularly at risk due to their reliance on Windows environments and the high value of their data. Additionally, organizations with remote or hybrid work models may face increased exposure if network access controls are insufficient. The availability of exploit code in Perl lowers the barrier for attackers, increasing the likelihood of exploitation. Although the vulnerability requires local access, the possibility of remote triggering expands the attack surface. The medium severity rating may underestimate the potential cascading effects of credential compromise in complex enterprise networks. Therefore, European organizations must consider this vulnerability as a serious threat to their cybersecurity posture.

Indicators of compromise

Exploit source code

Exploit code for Microsoft - NTLM Hash Disclosure Spoofing (library-ms)1,894 characters

# Exploit title: Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
# Exploit Author: John Page (aka hyp3rlinx)
#  x.com/hyp3rlinx
# ISR: ApparitionSec

Back in 2018, I reported a ".library-ms" File NTLM information disclosure vulnerability to MSRC and was told "it was not severe enough", that being said I post it anyways.
Seven years passed, until other researchers re-reported it.

Subsequently this security flaw was finally deemed important by Microsoft and it received CVE-2025-24054, for …

References

Community reviews

Loading reviews…