漏洞概述 CVE-2025-24054 是一个与 NTLM 哈希披露 相关的漏洞，通过欺骗方式利用。攻击者可以使用精心制作的 文件在野外进行利用。该漏洞自 2025年3月11日 起在野外被观察到，允许攻击者获取 NTLM 哈希、用户密码和凭据系统。尽管微软在 2025年3月11日 发布了补丁，但攻击者仍在积极利用该漏洞。 影响范围 目标机构：波兰和罗马尼亚的政府及私人机构。 攻击手段：攻击者使用恶意软件分发包含多个漏洞利用的 Dropbox 链接，包括 CVE-2025-24054 和 NTLMv2-SSP 哈希。 初始报告：最初认为漏洞利用发生在 文件被解压缩时，但微软的补丁文档指出，漏洞甚至可以通过最小用户交互触发，如右键点击、拖放或执行任何操作。 修复方案 微软补丁：微软在 2025年3月11日 发布了补丁，但攻击者仍在积极利用该漏洞。 Check Point Research：报告了多个利用该漏洞的活动，包括 CVE-2025-24054 和 CVE-2024-4351。 POC代码 1. library.xml 文件示例 2. 网络流量示例 ```plaintext SMB2:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x0000000000000000:0x000000000000