NTLM Hash Leak via File Explorer Preview?
Yes, Windows File Explorer’s preview pane can leak NTLM hashes when you preview a crafted file, because the preview handler loads the file and triggers an outbound SMB connection to a remote server under the attacker’s control. This is a well-known attack class (often called “NTLM theft� or “hash relay�) that has been demonstrated with files such as .docx, .xlsx, .pdf, and even some image formats. The leak occurs automatically when the preview pane is enabled and you click on a malicious file, without any additional user interaction beyond the click.
Background: What Are NTLM Hashes and Why Do They Matter?
NTLM (NT LAN Manager) is a legacy authentication protocol used by Windows for network authentication. When you access a resource on a Windows network, your computer may automatically send an NTLM challenge-response, which includes a hash of your password. If an attacker captures that hash, they can attempt to crack it offline or use it in a “pass-the-hash� attack to impersonate you on the network. Even if the password is strong, the hash can be relayed to other services that accept NTLM, potentially giving the attacker access to email, file shares, or other systems.
The preview pane in File Explorer is a feature that shows a thumbnail or a quick view of a file without opening it in its full application. To do this, Windows uses “preview handlers� – small components that render the file’s content. These handlers are often the same code that the full application uses, and they may process embedded content such as images, links, or OLE objects. If a file contains a reference to a remote SMB path (e.g., \\attacker\share), the preview handler may try to connect to that path to fetch the content, and in doing so, it automatically sends the user’s NTLM credentials.
How the Attack Works: The Role of SMB and UNC Paths
The attack relies on the fact that Windows automatically authenticates to SMB (Server Message Block) shares using the current user’s credentials. When a preview handler encounters a UNC (Universal Naming Convention) path like \\evil.com\share, it attempts to connect to that share. The SMB protocol then performs an NTLM challenge-response, during which the client sends a hash of the user’s password. The attacker’s server captures this hash.
To trigger the leak, an attacker crafts a file that contains such a UNC path. For example, a Word document can include an embedded image whose source is a remote SMB path. When Windows Explorer previews the document, the preview handler tries to load that image, and the SMB connection is made. Similarly, a PDF can contain a remote URI that triggers a connection. Even some image formats (like SVG) can contain external references.
Importantly, the preview pane must be enabled. In Windows Explorer, you can enable the preview pane by clicking “Preview pane� in the Layout menu on the View tab. When it’s on, simply selecting a file (clicking it once) triggers the preview. If the preview pane is off, the leak may not occur until you double-click the file to open it, which is a more explicit action but still risky.
Real-World Examples and Proof of Concept
Security researchers have published proof-of-concept files that demonstrate this issue. For example, a .docx file with an external image reference to \\attacker\a will cause the preview to attempt an SMB connection. Similarly, a .xlsx file with an external link in a cell can trigger the leak. Even a .pdf with an embedded action that opens a file URI can work. The attack has been demonstrated on fully patched Windows 10 and Windows 11 systems, because it abuses the design of NTLM and preview handlers, not a specific unpatched vulnerability.
Microsoft has addressed some specific vectors over the years, but the general class of attack persists because it is a feature of how Windows handles remote content. For instance, Microsoft has added mitigations like blocking NTLM authentication to untrusted servers in some configurations, but these are not enabled by default. The preview pane remains a risk if you enable it and open files from untrusted sources.
How to Protect Yourself: Practical Mitigations
There are several steps you can take to reduce the risk of NTLM hash leakage via File Explorer preview:
- Disable the preview pane if you don’t need it. This is the most direct mitigation. In Windows Explorer, go to the View tab and click “Preview pane� to turn it off. Use the “Details pane� instead if you need file metadata.
- Block outbound SMB (port 445) at your firewall. This prevents any SMB connection to external servers, which stops the leak even if a preview handler tries to connect. However, this may affect legitimate network shares.
- Enable NTLM blocking via Group Policy. You can set “Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers� to “Deny all� or “Audit all�. This is a more advanced setting that may break legacy applications.
- Use a standard user account instead of an administrator account. The hash is still sent, but the impact is limited if the attacker can’t escalate privileges.
- Be cautious with files from untrusted sources. Even if the preview pane is off, double-clicking a malicious file can trigger the leak. Only open files from sources you trust.
- Keep Windows updated. While not a complete fix, updates may patch specific preview handler vulnerabilities.
Common Misconceptions: “It’s Only a Local Issue� and “Macros Are the Only Vector�
One common misconception is that the preview pane only renders the file locally, so no network traffic occurs. In reality, preview handlers can be quite complex and may fetch remote resources as part of rendering. Another misconception is that only Office files with macros are dangerous. While macros are a common vector, the preview leak does not require macros – it only requires an embedded remote reference. Even a simple PDF with a remote GoToR action can trigger it.
Another misconception is that the attack only works on unpatched systems. As noted, this is a design issue, not a patchable bug. Even fully updated systems are vulnerable unless you apply the mitigations above. The attack is also often confused with “SMB Relay� – the difference is that NTLM theft captures the hash, while relay uses the captured hash to authenticate to a different service. Both are serious, but they are distinct.
Comparison with Other Attack Vectors
File Explorer preview is just one of many ways to trigger an NTLM hash leak. Other vectors include:
- Outlook – Emails with remote images or attachments can trigger SMB connections.
- Browser – Visiting a website with a
file://link or an SMB URL can trigger a connection. - Windows Search – Indexing a file with a UNC path may cause a connection.
- Thumbnail generation – Even without the preview pane, generating thumbnails for certain file types can trigger the leak.
The preview pane is particularly dangerous because it requires minimal user interaction – just a single click on a file. Other vectors may require more explicit actions like opening an email attachment or clicking a link. This makes the preview pane a high-priority target for attackers.
Frequently Asked Questions
Does disabling the preview pane completely prevent the leak?
Disabling the preview pane prevents the automatic preview that occurs when you click a file. However, the leak can still occur if you double-click the file to open it, or if other components like thumbnail generation or Windows Search index the file. So it reduces the risk but does not eliminate it.
Can I safely preview files if I’m not on a network?
If you are completely offline, the SMB connection attempt will fail, and the hash will not be sent anywhere. However, if you are connected to any network (even a home Wi-Fi), the connection may be attempted to the attacker’s server, so being “offline� is not a reliable protection.
Are there any file types that are safe to preview?
No file type is inherently safe, because preview handlers are complex and can have vulnerabilities. Even plain text files can theoretically trigger a leak if the handler has a bug. The safest approach is to disable the preview pane entirely or only enable it for files from trusted sources.
Does this affect Windows 11 as well as Windows 10?
Yes, both Windows 10 and Windows 11 are affected, as they share the same preview handler architecture. Microsoft has not disabled the preview pane by default, so the risk is present on both operating systems.
Can an attacker get my actual password, or just the hash?
The attacker captures the NTLM hash, not the plaintext password. However, the hash can be cracked offline if the password is weak, or used in a pass-the-hash attack to access resources that accept NTLM. So it is a serious credential theft.
Is there a way to preview files safely without disabling the pane?
You can use a third-party file viewer that does not use Windows’ preview handlers, but that is not a standard solution. The most reliable method is to disable the preview pane and rely on the details pane for metadata.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.