module

CVE-2025-33053 Exploit via Malicious .URL File and WebDAV

Try Surface Command
Back to search
Disclosed
Jun 11, 2025
Created
Jun 29, 2025

Description

This module exploits CVE-2025-33053 by generating a malicious .URL file pointing
to a trusted LOLBAS binary with parameters designed to trigger unintended behavior.
Optionally, a payload is generated and hosted on a specified WebDAV directory.
When the victim opens the shortcut, it will attempt to access the WebDAV path,
potentially resulting in remote code execution via a trusted binary.

Authors

Alexandra Gofman
David Driker
Dev Bui Hieu

Platform

Windows

Architectures

x64, x86, aarch64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/windows/fileformat/unc_url_cve_2025_33053
    msf exploit(unc_url_cve_2025_33053) > show targets
        ...targets...
    msf exploit(unc_url_cve_2025_33053) > set TARGET < target-id >
    msf exploit(unc_url_cve_2025_33053) > show options
        ...show and set options...
    msf exploit(unc_url_cve_2025_33053) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report