Windows NTLM Information Disclosure Spoofing Vulnerability

This repository is a minimal proof-of-concept for CVE-2025-59284 targeting libarchive. It contains only two files: a short README with usage instructions and one Python script, poc.py, which is the sole exploit implementation. The script does not exploit a service directly; instead, it generates a malicious TAR archive intended to be consumed later by a vulnerable application or workflow using libarchive. The exploit capability is archive crafting. Specifically, poc.py manually builds a 512-byte TAR header, sets the TAR typeflag to '1' to indicate a hardlink entry, places a user-controlled value in the filename field, and places a user-controlled target path in the linkname field. It then computes a valid TAR checksum and writes the header plus the required two zero blocks to produce a syntactically valid TAR file. The README example shows the intended abuse case: embedding a UNC path such as \\IP\Share\test.pdf as the hardlink target, suggesting the PoC is meant to coerce a vulnerable libarchive consumer into resolving or interacting with a remote SMB share. Repository structure is extremely small and straightforward: README.md documents the CVE claim and command-line usage, while poc.py is a standalone Python entry point. There is no framework integration, no shellcode, no post-exploitation logic, and no detection functionality. The code is best classified as a POC rather than an operational exploit because it only creates the malicious archive artifact and leaves triggering and any downstream impact to the vulnerable target environment.