LNK Remote Code Execution Vulnerability in Microsoft Windows Shell

This repository is a small research/PoC package for CVE-2017-8464, a Windows Shell/shortcut handling vulnerability exploitable via removable media. The repo contains mostly documentation plus one C++ DLL payload source file. The intended exploit chain is: generate a malicious .lnk shortcut that references an attacker-controlled DLL using an absolute path on a USB drive, place both on the USB device, and rely on Windows Explorer icon processing to load the DLL when the victim opens the drive. The included DLL source in `Src Build/dllmain.cpp` is the active exploit payload: on `DLL_PROCESS_ATTACH`, it pins itself in memory with `GetModuleHandleEx` and spawns a new thread that runs `WinExec("calc.exe", SW_SHOW)`, making the PoC visibly launch Calculator. The repository does not include the .lnk generator itself; instead, it points users to an external Python script from nixawk's repository and explains that the crafted shortcut must use an absolute drive-letter path such as `F:\Pwned.dll` for reliability. Structure-wise, `README.md` explains the vulnerability, root cause, debugging notes, and build/use guidance; `Exploit/README.md` gives a brief operational note about USB drive-letter assumptions; `Src Build/README.md` and `Make_PoC.txt` provide setup instructions and the external builder reference; `Src Build/dllmain.cpp` contains the only code. Overall, this is a real exploit PoC rather than a detector: it demonstrates arbitrary code execution through malicious DLL loading from a USB-hosted shortcut, with a benign demo payload that launches Calculator.

This repository contains a single Metasploit module that exploits CVE-2017-8464, a vulnerability in the way Windows handles shortcut (.LNK) files with dynamic icons. The exploit generates a malicious LNK file that references a DLL (typically with a .cpl extension) as its icon. When the LNK file is viewed (e.g., in Windows Explorer), Windows loads the referenced DLL, resulting in code execution. The module allows the user to specify the filenames and paths for the LNK and DLL files, and can generate multiple LNK files for different drive letters (D: through Z:), making it suitable for use with USB drives or shared folders. The payload is a DLL generated by Metasploit, allowing for customizable post-exploitation actions. The exploit targets unpatched versions of Microsoft Windows as of June 2017. The attack vector is local, typically via removable media or shared folders. The main fingerprintable endpoints are the generated LNK and DLL files.

This repository contains a single Metasploit module (modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb) that exploits CVE-2017-8464, a local privilege escalation vulnerability in Microsoft Windows. The exploit abuses the way Windows processes shortcut (.LNK) files with dynamic icons, allowing an attacker to load a malicious DLL by crafting a special LNK file with a Control Panel SpecialFolderDataBlock. The module generates a DLL containing the attacker's payload and a corresponding LNK file, both written to a writable directory (defaulting to %USERPROFILE% or a user-specified path). When the LNK file is indexed or previewed by Windows, the malicious DLL is loaded, resulting in code execution with elevated privileges. The module is operational, requiring a Meterpreter session on a vulnerable Windows system, and supports both x86 and x64 architectures. No network endpoints are involved; the attack vector is local file system manipulation. The code is well-structured, leverages Metasploit's EXE and FileDropper mixins, and provides options for customizing the LNK and DLL filenames and display properties.