Pennyw0rth
Module request: drop_library
Please Describe The Problem To Be Solved CVE-2025-24054 is a vulnerability that allows, in a fashion very similar to several other methods already covered by the scuffy, slinky, and drop-sc modules, NetNTLMv2 hash exfiltration via write access to SMB shares. However, this requires manual exploitation at the moment. Therefore, it would be very helpful to have an analogous module to go along with the other three that already drop .scf, .lnk, and .searchconnector-ms files, respectively, to drop .library-ms files that achieve the same result.
I'm working on a module implementing the attack, heavily influenced by the code of drop_sc, slinky and others. The code is quite basic but currently I can't get any hashs from this method (I working with a basic GOAD environment, without recent update).
EDIT : It work now, I just missed some typo in the payload. I'll create a PR soon
