one thing that i appreciate about your videos is that you zoom the screen big enough to make it easier to read and watch. and i think people don't point that out enough. thanks.

SMB seems like it's primarily a vulnerability generating protocol that just happens to also let you share files

Very old trick, i remember using this to infect my teachers computer so i could steal the tests early

really seems like Microsoft should implement some security measures for these scf files

You’re a machine man. Your work ethic is next level

Yooo, I swear you always have the most absurd things in windows to perform malicious actions with, absolutely love it!

Running and gunnin! Hotel YT production. Good to see you John! Great video

The point is clear - you have just to make somehow a request from victim PC via SMB, fool it that you're going to authenticate it and it gives you it's NTLM hash. But, I couldn't replicate this attack (at least this way). I've done exactly how did you in video and simply nothing happened. Responder was listening correctly and all VMs were in the same network. Windows 10 nor Windows 7 responds to this. Guest OS: Windows 10, Kali Hypervisor: Virtualbox Networking: Bridged (both of them)

I'm too dumb to understand everything You present, but how I have been told "I love when You speak technical to me"

Love, John Hammond. :)

It's really cool to get this working :P Love your content!

Thanks John, you the boss!

Thank you for the awesome content, Scary that this works on network file shares and USB drives.

Windows is the Devil

ok that is really cool. Thank you for doing these types of videos.

Great content as always!! TY!

I am, have always been and plan on always being...a shift+delete kind of person.

A small correction: You meant "relay" the hash not "pass" because pass the hash attacks are different than NTLM relay attacks. It's quite confusing because of the misused terminology (I did it in the previous sentence as well for traditional reasons :D). But the pass-the-hash attack uses the password hash stored on the machine to generate NetNTLMv2 hashes that will be sent through the network. Relay attacks catch a NetNTLMv2 hash (just like responder does) and sends it through to another service that accepts NTLM authentication. Key differences: NetNTLMv2 hashes cannot be used for long, they expire. SMB signing (in case of SMB servers) can defend against relay attacks (but it will have like a 30% performance cut) while pass-the-hash attacks will work even if it's enabled.

So powerfull! If a read teamer put this file in a smb share for example, whould the .ico be fetched by any viewers of the share? Or the ico will be cached by the DC?

Literally amazing 😲😲😲😎

Alright, so you can set a custom icon for a richtext file or word document... 🤷‍♂ Seems cool, but noone really uses it afaik. But then allowing a network location for an icon, on a local document file is really odd🤦‍♂, I don't think anyone asked for that feature whatsoever.

Love ur vids

I just did something like this not that long ago and pwnd the SOC for the folks that I was working for. I downloaded an SCF to my computer which pointed to my host on the Internet, well the SOC saw the file saved it their desktop and all of the sudden I had a connection to my host from one of the SOC users (which BTW had admin rights on an S* load of systems) after that I used his credentials, with pass the hash, to own the place.

Hi John, Thank you for all the information you share with all of us! I need some help some Russians hacked my email account so I have changed all passwords as required. I have the ip address it was accessed from. How can I revert their action towards them back?

yow John, unrelated topic here, just want to ask if you know how to install linux mint or ubuntu dual boot with windows 10 if i don't have flash drive and dvd to create bootable installer. thanks

we cannot make pass the hash with ntlmv2

Wonder if all these vulnerabilities are recognized by Huntress?

you should make a anti-viris, malware...etc

The same with .lnk except the arrow.

thats mad, and i alrway riht click recycle bin to empty it i never open it luckily but i see the point any icon can be used lol

Mind blown

I need that for iPhone and for any laptop in S mode windows

You wouldn't be able to "pass the hash" this isn't ntlm, this is a different format known as net-NTLM, you can relay this though, so long as there is no signing in place.

I have known this for *quite* a while. And there's a bug related to this that might be exploitable too. 😄 It was fun to toy around with, but since nobody was interested i just ignored it for a while. 🤷‍♂

You are the one 💪

Hell yeah new video

Doesn't seem to work on Windows 11

Hey John big fan here, one thing though I noticed that this only works on windows 10 and does not give me the hash when I tried it on windows 11 is there any reason for that?

Neat info

You find the strangest things :)

Does it still dump the hashes and info via flash disk usage Without placing it in the system storage

I will never use an SCF file again (maybe)

My recycle bin is named Garbage

Don't give me ideas.

Classic John Hammond, always traveling so we can't pinpoint his location with OSINT

Ima try this exploit on a big corporation xd

Interesting

COOL!

WHAT 1 MINUTE AGO?

can you makea udemy cours please?thanks

the odd thing on your desktop is that you use google chrome

👍🏽

HA

🇦🇿🇦🇿🇦🇿🇦🇿🇦🇿🇦🇿🇦🇿

First

hate to be that guy but first

"... will *never show* its file extension ..." That's only true as long as the "NeverShowExt" Registry Value is present under SHCmdFile [HKCR\.scf points to HKCR\SHCmdFile].

"I'm trying to drag this file to the bin but it just WILL NOT GO IN THERE" 😅🤣 Another fun option would be to change the right-click context options for this file to look like it is a recycle bin - the context menus for the bin vs. files look pretty different and someone who is apprehensive might be able to figure out something is up just by right clicking the file and seeing no recycle-related-options. But maybe not if it looks exactly like the bin menus. OR ... could you somehow link the trap file to the REAL recycle bin, and simply pass the user in a way that looks normal? (IE: logs info, then just opens the real recycling bin so fast the user would never notice)

Probably just me but you sound like Seth Rogen if he wasn't a weed smoker 🫡👌

Windoze is and always has been a train wreck

First