[caca28sapo1]

Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute the file—simply extracting it is enough to trigger the leak.

usage:

>>python poc.py

>>enter file name: your file name

>>enter IP: attacker IP

Link:

Hidden Content

You must register or login to view this content.

[qian30090]

Thanks, this worked for me

[krypt0n1337]

nice mind blowing content from u brother

[oralnephew]

Thanks, will give this a try!
If I end up writing anything myself I will create a new thread and credit you.

[tr1nit1s]

Thank you! I will give it a try

[grainchord]

Thanks for sharing, not seen this one before

[taw27409]

Thank you for poc

[wut]

Thanks for sharing, lemme check

[ACT111]

Thank you very much. I really need this.

[shodanuser]

I don’t know abt that