Random-Scripts
star-sg/random-scriptsCollection of DFIR and OSINT Python scripts for parsing malicious LNK samples, extracting OLE objects from MHTML, and hashing favicons to hunt…
digital-forensicsforensicshash-analysis+5
2
star-sg/random-scriptsCollection of DFIR and OSINT Python scripts for parsing malicious LNK samples, extracting OLE objects from MHTML, and hashing favicons to hunt…
f0xox/cve-2026-32202Technical analysis of CVE-2026-32202, a zero-click NTLM credential coercion via crafted .lnk Control Panel applet items in Windows Explorer.
virus-or-not/cve-2026-32202Generates LNK files with crafted _IDCONTROLW structures to research Windows Shell spoofing vulnerabilities CVE-2026-21510 and CVE-2026-32202,…
solarlynxsqueeze/cve-2026-32202Generates malicious LNK files to coerce Net-NTLMv2 hashes via Windows Shell UNC handling, with custom SMB listener and relay integration for…
epsilonpointori/epsilonpointlnkGenerates obfuscated .lnk files exploiting CVE-2026-21510 with LNK stomping, encrypted payloads, and anti-forensics for authorized penetration…
playboisk8/poc-cve-2017-8464-opencalculatorExploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.
trustedsec/lnkmemaybeLnk crafting and research tools
capture0x/peyara-fileuploadPeyara Remote Mouse Unauthenticated Arbitrary File Upload
xssfile/cve-2017-8464-expExploit for CVE-2017-8464 LNK remote code execution vulnerability. Generates malicious .lnk files for USB-based payload delivery, supporting x86 and…
ash1996x/cve-2025-50154-aggressor-scriptCobalt Strike Aggressor script that weaponizes LNK and Library-MS files to trigger SMB NTLMv2 hash disclosure, including CVE-2025-24054 bypass, for…
3gstudent/cve-2017-8464-expSupport x86 and x64
amperclock/cve-2025-9491_pocProof-of-Concept of the CVE-2025-9491 using invisible characters in the arguments of a Windows shortcut file (.lnk)
9aylas/shortcut-payload-generatorAutoIt HackTool, Shortcuts .lnk Payloads Generator As LNK-KISSER.
quickbreach/smbetraySMB MiTM tool with a focus on attacking clients through file content swapping, lnk swapping, as well as compromising any data passed over the wire in…
mdsecactivebreach/farmerHarvests NetNTLM hashes in Windows domains via a local WebDAV server, with LNK file poisoning and Office document field code injection for lateral…
0xthirteen/staykitCobalt Strike extension for post-exploitation persistence using SharpStay .NET assembly. Provides GUI-driven persistence via Registry keys, Scheduled…
0xthirteen/sharpstay.NET tool for installing Windows persistence via registry keys, scheduled tasks, services, WMI events, COM hijacks, and LNK backdoors, supporting…