Last updated
Was this helpful?
Last updated
Was this helpful?
This tool will create several documents/files that if accessed by the user somehow they will start a NTLM authentication with the attacker.
Browse to Folder Containing:
.url – via URL field
.url – via ICONFILE field
.lnk - via icon_location field
.scf – via ICONFILE field (Not Working on Latest Windows)
autorun.inf via OPEN field (Not Working on Latest Windows)
desktop.ini - via IconResource field (Not Working on Latest Windows)
Open Document:
.xml – via Microsoft Word external stylesheet
.xml – via Microsoft Word includepicture field
.htm – via Chrome & IE & Edge img src (only if opened locally, not hosted)
.docx – via Microsoft Word includepicture field
-.docx – via Microsoft Word external template
-.docx – via Microsoft Word frameset webSettings
-.xlsx - via Microsoft Excel external cell
-.wax - via Windows Media Player playlist (Better, primary open)
-.asx – via Windows Media Player playlist (Better, primary open)
-.m3u – via Windows Media Player playlist (Worse, Win10 opens first in Groovy)
-.jnlp – via Java external jar
-.application – via any Browser (Must be served via a browser downloaded or won’t run)
Open Document and Accept Popup:
.pdf – via Adobe Acrobat Reader
Click Link in Chat Program:
.txt – formatted link to paste into Zoom chat
Example :
Cheatsheet
This is a list of techniques to force NTLM authentications to steal credentials from the victim.
You may be able to force a windows machine to authenticate to an arbitrary machine using a privileged account. Read the following page to learn more:
The include() in PHP will resolve the network path for us.
In here I’m using “php://filter/convert.base64-encode/resource=” that will resolve a network path.
Usually, doc() is used in out-of-band XPath injections, thus can be applied in resolving a network path.
Since stacked queries are supported we can call stored procedures.
Accidently found this one while experimenting with .sct files.
There are many possible ways you can explore
You just need to type ‘\host\’ the auto-complete will do the trick under the explorer and the run dialog box.
Starting from Windows 7 this feature is disabled. However you can enable by changing the group policy for Autorun. Make sure to hide the Autorun.inf file to work.
You can save this as something.scf and once you open the folder explorer will try to resolve the network path for the icon.
The desktop.ini files contain the information of the icons you have applied to the folder. We can abuse this to resolve a network path. Once you open the folder you should get the hashes.
In Windows XP systems the desktop.ini file uses ‘IcondFile’ instead of ‘IconResource’.
We can create a shortcut containing our network path and as you as you open the shortcut Windows will try to resolve the network path. You can also specify a keyboard shortcut to trigger the shortcut. For the icon you can give the name of a Windows binary or choose an icon from either shell32.dll, Ieframe.dll, imageres.dll, pnidui.dll or wmploc.dll located in the system32 directory.
The Powershell version.
Another shortcut in Windows is the Internet shortcuts. You can save this as something.url
You can add a new registry key in any of the following paths.
There are probably many scriptlets in Powershell that would resolve a network path.
IE will resolve UNC paths. For example
You can inject under XSS or in scenarios you find SQL injection. For example.
You can save this as .vbs or can be used inside a macro that is applied to Word or Excel files.
You can apply in web pages but this works only with IE.
Here’ the encoded version. You can encode and save this as something.vbe
You can apply this in html files too. But only works with IE. You can save this as something.hta which will be an HTML Application under windows, which mshta.exe will execute it. By default it uses IE.
You can save this as something.js under windows.
You can apply the same in html files but only works with IE. Also you can save this as something.hta.
Here’s the encoded version. You can save this as something.jse.
The html version of this.
Save this as something.wsf.
Here’s a small shellcode I made. This shellcode uses CreateFile and tries to read a non-existing network path. You can use tools such as Responder to capture NetNTLM hashes. The shellcode can be modified to steal hashes over the internet. SMBRelay attacks can also be performed.
Here’s the above shellcode applied inside a Word/Excel macro. You can use the same code inside a VB6 application.
There might be many other ways in Windows. You never know! 🙂
I have written a complete on MySQL out-of-band injections which can be applied over the internet. You can also use ‘INTO OUTFILE’ to resolve a network path.
subTee has done many kinds of research with JS and DynamicWrapperX. You can find a POC using the DynamicWrapperX DLL. Based on that I have ported the shellcode to JS and VBS. The fun part is we can embed shellcode in JScript or VBScript inside html and .hta formats. Note the following shellcode directs to my IP.
****
