\\attacker-ip\share) forces the victim’s machine to authenticate to it over SMB, handing over an NTLMv2 hash in the process. Drop one of these into a writable file share and capture every hash of everyone who browses it, no interaction beyond opening the folder required.
Legacy: SCF / LNK
Icon-path and shortcut-target resolution, both well known and both still worth trying, Windows Explorer’s handling has shifted over the years but neither is fully dead everywhere.
Modern: URL / Library
.url internet shortcuts and .library-ms/.searchConnector-ms files achieve the same effect through a different resolution path, useful when the legacy formats get blocked.All of these need a listener on the attacking side to actually capture anything, Responder/Inveigh, set up the same way as on LLMNR/NBT-NS/mDNS Poisoning, the technique here is just a different way to trigger the authentication attempt, not a different way to catch it.
SCF (Shell Command File)
SCF files are used by Windows Explorer for basic folder navigation (show desktop, move up a directory). Explorer resolves an SCF’sIconFile path as soon as the containing folder is displayed, pointing that path at an SMB share you control is enough to trigger an authentication attempt from anyone who simply opens the folder.
1
Create the SCF file
Name it something that blends into the share,
@Inventory.scf sorts near the top of a directory listing and looks like a normal spreadsheet companion file.2
Fill in the icon path
3
Start Responder to catch the auth attempt
4
Drop it on a writable share and wait
Any user with Explorer open to that folder triggers the SMB lookup automatically, Responder logs the NTLMv2 hash as soon as it comes in.
Malicious .LNK File
Since SCF stopped working on newer hosts, a malicious.lnk (shortcut) file achieves the same result through its icon location instead, Explorer resolves a shortcut’s icon the moment the folder is listed, exactly like the SCF trick, just through a different file format.
Writing one by hand is fiddly (the LNK binary format isn’t plain text), LNKBomb generates one directly, or a few lines of PowerShell do the same job without any extra tooling.
.URL (Internet Shortcut) Files
A classic.url internet-shortcut file, normally used to bookmark a web page from the desktop, triggers the same UNC resolution when its IconFile property points at an SMB path instead of a local or HTTP one.
.library-ms / .searchConnector-ms
Library and search-connector files define a virtual folder that aggregates content from one or more real locations, including a UNC path, and Explorer resolves that location as soon as the library is opened. Create a file calledInventory.library-ms (or Inventory.searchConnector-ms, same content works for either extension) with the XML below, pointing <url> at the attacker-controlled SMB share, then drop it on the writable share just like the SCF/LNK/URL files above.
Direct Trigger: search-ms: URI
No file needs to be dropped at all, the same search-connector resolution fires from a link using Windows’ search-ms: protocol handler directly. Send it as a link in a phishing email/document, or embed it in a shortcut, clicking it resolves the UNC location exactly like a .searchConnector-ms file would.
Quick Reference Tools
LLMNR / NBT-NS / mDNS Poisoning
The broadcast-poisoning sibling technique, same listener setup, different trigger.
LNKBomb
Generates malicious .lnk files for this exact technique without hand-building the binary format.