This module exploits CVE-2025-33053 by generating a malicious .URL file pointing to a trusted LOLBAS binary with parameters designed to trigger unintended behavior. Optionally, a payload is generated and hosted on a specified WebDAV directory. When the victim opens the shortcut, it will attempt to access the WebDAV path, potentially resulting in remote code execution via a trusted binary.
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/fileformat/unc/url_cve_2025_33053msf undefined(url_cve_2025_33053) > show actions ...actions...msf undefined(url_cve_2025_33053) > set ACTION < action-name >msf undefined(url_cve_2025_33053) > show options ...show and set options...msf undefined(url_cve_2025_33053) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub