# The new zero-day hole is to steal the authentic information of NTLM on Windows operating system

A new zero-day vulnerability has been discovered in the Windows operating system that allows attackers to steal a user's NTLM credentials simply by tricking them into viewing a malicious file in Windows Explorer.

## **Overview**

In March 2025, several analysts discovered two critical Windows vulnerabilities: **CVE-2025-21308 and CVE-2025-21377**, which lead to the exposure of NTLM credentials. These vulnerabilities allow attackers to collect a user's NTLM credentials by tricking them into viewing a malicious file in Windows Explorer, such as opening a shared folder or USB drive containing the file, or viewing the Downloads folder where the file has been automatically downloaded from the attacker's website.

Currently, Microsoft has not released an official patch for these vulnerabilities. However, ACROS Security has provided unofficial patches through their 0patch service for all affected Windows versions. These patches are available for free until Microsoft releases an official patch.

## **Vulnerability Information**

1. **CVE-2025-21308**
    
    * Description: **CVE-2025-21308 is a security vulnerability related to the Windows Themes feature in the Windows operating system, announced on January 14, 2025.**
        
    * CVSS Score: **6.5**
        
    * Severity Level: **Medium**
        
    * Impact: **This vulnerability allows an attacker to perform spoofing by convincing a user to download and apply a malicious theme file.**
        
2. **CVE-2025-21377**
    
    * Description: **CVE-2025-21377 is a security vulnerability related to the disclosure and spoofing of NTLM hashes in the Windows operating system, announced on February 11, 2025.**
        
    * CVSS Score: **6.5**
        
    * Severity Level: **Medium**
        
    * Impact: **This vulnerability allows an attacker to collect a user's NTLMv2 credentials, which can lead to unauthorized access to the system and sensitive data.**
        

## **Affected Versions**

**Affected Versions:** The vulnerability affects multiple versions of Windows, including:​

* Windows 10 (versions from 1507 to 22H2)​
    
* Windows 11 (versions from 22H2 to 24H2)​
    
* Windows Server 2008, 2012, 2016, 2019, 2022, and 2025
    

## **Vulnerability Details**

The two vulnerabilities, **CVE-2025-21308** and **CVE-2025-21377**, can be exploited in attack campaigns to steal NTLM credentials and perform spoofing attacks. Here is how an attacker might exploit these vulnerabilities in a targeted campaign:

Initially, attackers will exploit the **CVE-2025-21308 (Windows Themes Spoofing) vulnerability to:**

* Trick users into downloading and applying a malicious Windows Theme file to steal NTLM credentials.
    
* Facilitate NTLM relay attacks or brute-force password hash attacks.
    

To execute this, hackers need to create a `.theme` file with malicious content, where the **wallpaper or sound scheme** is customized to point to a **remote SMB or WebDAV server** controlled by the attacker.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743390293392/fe168d1c-d974-4ad7-b7d7-f5c337a2d48c.png align="center")

\=> Here, `\\attacker-server\share\malicious.jpg` is a remote SMB path. When Windows tries to load this wallpaper, it will **automatically send the user's NTLMv2 hash** to the attacker's server.

After creating the `.theme` file, the attacker will **distribute it to victims** using methods such as:

* **Sending via email** as an attachment or download link.
    
* **Embedding in websites** for users to unknowingly download.
    
* **Bundling in malicious software packages** or game mods.
    

When users **open or apply the** `.theme` file, Windows will attempt to load the theme components (wallpaper, icons, sounds, etc.). If the theme has a **wallpaper from a remote SMB/WebDAV path**, Windows will automatically send the user's NTLMv2 credentials to the attacker's server.

After obtaining the victim's NTLM hash or NTLM relay, the attacker will continue to exploit the **CVE-2025-21377** vulnerability for two main purposes:

* **Use the NTLM hash to perform NTLM relay attacks** on Windows internal services (SMB, RDP, LDAP...).
    
* **Decrypt the NTLM hash** to obtain the victim's password.
    

To decrypt the NTLM hash, the attacker has two options:

* **Decrypt the NTLM hash using brute-force**
    
    * If the password is weak, the attacker can **crack the password and access the victim's Windows account using the Hashcat tool**.
        

* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743391042617/6d0a016b-6fd4-4856-904a-60a8a979fa5d.png align="center")
    
* **Relay NTLM to access other systems**
    
    * If the internal system **supports NTLM authentication**, the attacker can **log into servers, access files, or gain administrative privileges**.
        
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743391312287/3eafa551-03e8-402e-9796-ef3043d2ac89.png align="center")
    

Finally, after obtaining enough login information, the attackers will proceed with privilege escalation:

* Use the collected information for privilege escalation.
    
* Perform Pass-the-Hash attacks to move to other systems within the internal network.
    

## **Recommendations**

1. **Update the system immediately**
    
    * [CVE-2025-21377 - Security Update Guide - Microsoft - NTLM Hash Disclosure Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21377)
        
2. **Disable NTLM If Possible (turn off NTLM on Windows)**
    
    * Open `Local Security Policy (secpol.msc)`, go to:
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743391803877/8f040f58-da18-487a-9242-e1d838dc2d81.png align="center")
        
    * Or use Group Policy:
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743391827337/caf8c7df-9c83-4d22-a979-fb62d7a59c70.png align="center")
        
3. **Block SMB/WebDAV Connections to the Internet**
    
    * Block SMB access on port **445** and WebDAV on **80/443** using the Firewall.
        
    * Use **Windows Defender Attack Surface Reduction (ASR)** to automatically block SMB/WebDAV.
        
4. **Block Malicious Theme & Shortcut Files (.theme, .lnk, .html)**
    
    * **Do not open** `.theme`, `.themepack`, `.desktopthemepackfile` from untrusted sources.
        
    * **Block these extensions in email & browsers:**
        
        * Use **Microsoft Defender for Office 365** to block `.theme`, `.lnk`, `.html` files.
            
    * **Block opening shortcut files from untrusted directories** using Group Policy:
        
5. **Enable SMB Signing to Prevent NTLM Relay**
    
    * If NTLM must be used, enable **SMB Signing** to prevent NTLM relay attacks.
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743391970918/af547eb5-7471-4172-bbd1-6e042e8efe42.png align="center")
        
6. **Use Multi-Factor Authentication (MFA)**
    
    * If possible, **require MFA** on all administrative and critical accounts.
        

## **Conclusion**

Both **CVE-2025-21308 and CVE-2025-21377** are serious vulnerabilities related to NTLM that can be exploited to collect NTLM hashes and perform **relay attacks or brute-force password attacks**. Exploiting these two vulnerabilities can pose significant risks if proper protective measures are not in place. Therefore, updating systems and applying security methods are the best ways to protect businesses and users from these attacks.

## **References**

1. [New Windows zero-day leaks NTLM hashes, gets unofficial patch](https://www.bleepingcomputer.com/news/security/new-windows-zero-day-leaks-ntlm-hashes-gets-unofficial-patch/)
    
2. [New Windows Zero-Day Flaw Lets Remote Attackers Steal NTLM Credentials — Unofficial Fix Now Available](https://cyberpress.org/new-windows-zero-day-flaw-lets-remote-attackers/?utm_source=chatgpt.com)