How to use Shortcut LNK Files on Windows - Malware Delivery Initial Access

Be better than yesterday -

This video showcases how shortcut files on Windows, the .LNK file extension, are often abused and exploited by malicious threat actors to gain initial access onto a victim's machine or a target organisation.

Shortcut files on Windows are often used as the first stage of attack chain - delivery, which the .LNK file will then proceed to download additional payloads onto the compromised machine. Shortcut files are usually sent to a victim via Spear-phishing/Phishing campaigns, often via email.

This video provides a simple and easy to understand demonstration on how the shortcut file on Windows can be configured to download and execute a malicious Meterpreter reverse shell binary. This video also provides a walkthrough of a research published by 'x86matthew', whereby he was able to embed the entire payload file into the Shortcut file itself.

DISCLAIMER:
All content posted on this Youtube channel is SOLELY FOR Educational and Awareness purposes ONLY. Any actions and/or activities related to the material presented in this Youtube channel is entirely YOUR responsibility.

We DO NOT promote, support, encourage any illegal activities such as hacking, and we WILL NOT BE HELD responsible in the event of any misuse and abuse of the content resulting in any criminal charges.

References for LNK file described in the video:

x86matthew EmbedExeLnk article:

Gemini Security Awesome Hacking T-Shirts - Support the channel:

Stay connected:

Timestamp:
00:00 Introduction on Windows LNK file
01:35 Typical LNK attack chain
02:17 x86matthew EmbedExeLnk research
03:00 Shortcut LNK file creation
03:40 MSFVenom payload generation and preparation
04:28 Weaponizing the shortcut LNK file with commands
05:21 Shortcut LNK file Meterpreter reverse shell demo
07:00 x86matthew EmbedExeLnk demo

[saidullahansari]

Great! make more videos about Powershell delivery method.😍😍

[everdomeio]

what about if i want to change the icon? for example if i want to use pdf how can add?

[TechKiddos]

can i compile this with MinGW ?
it said "undefined reference to `__imp_CLSIDFromString'"

even after using ole32.

[hiddengo]

plzzzz make more videos on initial access and defense evasion

[kolanhakmi-jlhc]

Hello @Gemini. Please can I get the already compiled lnk file? I think I'm having issues trying to setup the cl.exe compiler on my pc. I suggest you upload the compiled file on mega or GitHub or anything. Just try and make it available please. Thanks in advance. Nice video though!!